Add Prohibited Processes to Enterprise Security.
annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
known_false_positives = None identified
@@ -4861,6 +4875,26 @@ annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]}
known_false_positives = unknown
providing_technologies = []
+[savedsearch://ESCU - Recon AVProduct Through Pwh or WMI - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+known_false_positives = network administrator may used this command for checking purposes
+providing_technologies = []
+
+[savedsearch://ESCU - Recon Using WMI Class - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+known_false_positives = network administrator may used this command for checking purposes
+providing_technologies = []
+
[savedsearch://ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule]
type = detection
asset_type = Endpoint
@@ -4875,7 +4909,7 @@ providing_technologies = []
type = detection
asset_type =
confidence = medium
-explanation = The search looks for command-line arguments used to hide a file or directory using the reg add command.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for command-line arguments used to hide a file or directory using the reg add command.
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]}
known_false_positives = None at the moment
@@ -4955,7 +4989,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search monitors for remote modifications to registry keys.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search monitors for remote modifications to registry keys.
how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out.
@@ -4965,10 +4999,10 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for wmic.exe being launched with parameters to operate on remote systems.
+explanation = The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. Deprecated because duplicate of Remote Process Instantiation via WMI.
annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
-known_false_positives = Administrators may use this legitimately to gather info from remote systems.
+known_false_positives = Administrators may use this legitimately to gather info from remote systems. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Resize ShadowStorage volume - Rule]
@@ -5148,7 +5182,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]}
known_false_positives = No known false positives
@@ -5191,7 +5225,7 @@ confidence = medium
explanation = This search looks for scripts launched via WMI.
how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
-known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.
+known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule]
@@ -5278,7 +5312,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
how_to_implement = The search requires that you are ingesting your vulnerability-scanner data and that it reports the CVE of the vulnerability identified.
annotations = {"cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]}
known_false_positives = It is possible that your vulnerability scanner is not detecting that the patches have been applied.
@@ -5298,12 +5332,22 @@ providing_technologies = []
type = detection
asset_type = Splunk Server
confidence = medium
-explanation = This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
how_to_implement = The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Whitelisting your Splunk systems will reduce false positives.
annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]}
known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information.
providing_technologies = []
+[savedsearch://ESCU - Start Up During Safe Mode Boot - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]}
+known_false_positives = updated windows application needed in safe boot may used this registry
+providing_technologies = []
+
[savedsearch://ESCU - Sunburst Correlation DLL and Network Event - Rule]
type = detection
asset_type = Windows
@@ -5328,7 +5372,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
how_to_implement = To successfully implement this search you need to be ingesting information on registry changes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` nodes.
annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
known_false_positives = There may be other processes in your environment that users may legitimately use to modify file associations. If this is the case and you are finding false positives, you can modify the search to add those processes as exceptions.
@@ -5368,7 +5412,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).
how_to_implement = You must be ingesting data from email logs and have Splunk integrated with UBA. This anomaly is raised by a UBA detection model called "SuspiciousEmailDetectionModel." Ensure that this model is enabled on your UBA instance.
annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]}
known_false_positives = This detection model will alert on any sender domain that is seen for the first time. This could be a potential false positive. The next step is to investigate and add the URL to an allow list if you determine that it is a legitimate sender.
@@ -5386,11 +5430,21 @@ annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Del
known_false_positives = None identified
providing_technologies = []
+[savedsearch://ESCU - Suspicious Event Log Service Behavior - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
+known_false_positives = It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed.
+providing_technologies = []
+
[savedsearch://ESCU - Suspicious File Write - Rule]
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search looks for files created with names that have been linked to malicious activity.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for files created with names that have been linked to malicious activity.
how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate.
@@ -5634,7 +5688,7 @@ providing_technologies = []
type = detection
asset_type = Windows
confidence = medium
-explanation = This search detects writes to the 'System Volume Information' folder by something other than the System process.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects writes to the 'System Volume Information' folder by something other than the System process.
how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
annotations = {"cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]}
known_false_positives = It is possible that other utilities or system processes may legitimately write to this folder. Investigate and modify the search to include exceptions as appropriate.
@@ -5706,7 +5760,7 @@ providing_technologies = []
type = detection
asset_type =
confidence = medium
-explanation = This search looks for applications on the endpoint that you have marked as uncommon.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for applications on the endpoint that you have marked as uncommon.
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search uses a lookup file `uncommon_processes_default.csv` to track various features of process names that are usually uncommon in most environments. Please consider updating `uncommon_processes_local.csv` to hunt for processes that are uncommon in your environment.
annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]}
known_false_positives = None identified
@@ -5732,11 +5786,23 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"
known_false_positives =
providing_technologies = []
+[savedsearch://ESCU - Unloading AMSI via Reflection - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]}
+known_false_positives = Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
+providing_technologies = []
+
[savedsearch://ESCU - Unsigned Image Loaded by LSASS - Rule]
type = detection
asset_type = Windows
confidence = medium
-explanation = This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
how_to_implement = This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]}
known_false_positives = Other tools could load images into LSASS for legitimate reason. But enterprise tools should always use signed DLLs.
@@ -5746,7 +5812,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search gives you the hosts where a backup was attempted and then failed.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search gives you the hosts where a backup was attempted and then failed.
how_to_implement = To successfully implement this search you need to obtain data from your backup solution, either from the backup logs on your endpoints or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your specific backup solution.
annotations = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
known_false_positives = None identified
@@ -5816,12 +5882,27 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for the creation of WMI permanent event subscriptions.
-how_to_implement = To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
+explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
+All event subscriptions have three components \
+1. Filter - WQL Query for the events we want. EventID = 19 \
+1. Consumer - An action to take upon triggering the filter. EventID = 20 \
+1. Binding - Registers a filter to a consumer. EventID = 21 \
+Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
+how_to_implement = To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes.
providing_technologies = []
+[savedsearch://ESCU - WMI Recon Running Process Or Services - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+known_false_positives = network administrator may used this command for checking purposes
+providing_technologies = []
+
[savedsearch://ESCU - WMI Temporary Event Subscription - Rule]
type = detection
asset_type = Endpoint
@@ -5846,7 +5927,7 @@ providing_technologies = []
type = detection
asset_type = Account
confidence = medium
-explanation = This search is used to identify the creation of multiple user accounts using the same email domain name.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to identify the creation of multiple user accounts using the same email domain name.
how_to_implement = We start with a dataset that provides visibility into the email address used for the account creation. In this example, we are narrowing our search down to the single web page that hosts the Magento2 e-commerce platform (via URI) used for account creation, the single http content-type to grab only the user's clicks, and the http field that provides the username (form_data), for performance reasons. After we have the username and email domain, we look for numerous account creations per email domain. Common data sources used for this detection are customized Apache logs or Splunk Stream.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]}
known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamolous behavior. This search will need to be customized to fit your environment—improving its fidelity by counting based on something much more specific, such as a device ID that may be present in your dataset. Consideration for whether the large number of registrations are occuring from a first-time seen domain may also be important. Extending the search window to look further back in time, or even calculating the average per hour/day for each email domain to look for an anomalous spikes, will improve this search. You can also use Shannon entropy or Levenshtein Distance (both courtesy of URL Toolbox) to consider the randomness or similarity of the email name or email domain, as the names are often machine-generated.
@@ -5856,7 +5937,7 @@ providing_technologies = []
type = detection
asset_type = account
confidence = medium
-explanation = This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
how_to_implement = Start with a dataset that allows you to see clickstream data for each user click on the website. That data must have a time stamp and must contain a reference to the session identifier being used by the website. This ties the clicks together into clickstreams. This value is usually found in the http cookie. With a bit of tuning, a version of this search could be used in high-volume scenarios, such as scraping, crawling, application DDOS, credit-card testing, account takeover, etc. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.
annotations = {"cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]}
known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosly written detections that simply detect anamoluous behavior.
@@ -5866,7 +5947,7 @@ providing_technologies = []
type = detection
asset_type = account
confidence = medium
-explanation = This search is used to identify user accounts that share a common password.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to identify user accounts that share a common password.
how_to_implement = We need to start with a dataset that allows us to see the values of usernames and passwords that users are submitting to the website hosting the Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized or hashed value of a password is acceptable and certainly preferable to a clear-text password. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.
annotations = {"cis20": ["CIS 16"], "nist": ["DE.DP"]}
known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior.
@@ -5974,10 +6055,10 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for Windows events that indicate one of the Windows event logs has been purged.
-how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts.
+explanation = The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
-known_false_positives = It is possible that these logs may be legitimately cleared by Administrators.
+known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Windows Security Account Manager Stopped - Rule]
@@ -5994,7 +6075,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
how_to_implement = You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = This process should not be ran forcefully, we have not see any false positives for this detection
@@ -6004,7 +6085,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search looks for modifications to the hosts file on all Windows endpoints across your environment.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for modifications to the hosts file on all Windows endpoints across your environment.
how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
annotations = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]}
known_false_positives = There may be legitimate reasons for system administrators to add entries to this file.
@@ -6114,7 +6195,7 @@ providing_technologies = []
type = detection
asset_type = GCP Account
confidence = medium
-explanation = This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally.
how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]}
known_false_positives = GCP Oauth token abuse detection will only work if there are access policies in place along with audit logs.
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 7be8609537..20b16a438c 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
-build = 30583
+build = 32018
[triggers]
reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple
[launcher]
author = Splunk
-version = 3.23.0
+version = 3.24.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index 9b04724183..166d906650 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:24 UTC
+# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 80a526948d..e01cb50393 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
[content-version]
-version = 3.23.0
+version = 3.24.0
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 9f9e31de50..c74af767cd 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -6,13 +6,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task", "panel://workbench_panel_get_notable_history___response_task"]
-[panel_group://workbench_panel_group_aws_cryptomining]
-label = AWS Cryptomining
-description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
-disabled = 0
-
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
-
[panel_group://workbench_panel_group_aws_iam_privilege_escalation]
label = AWS IAM Privilege Escalation
description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
@@ -34,13 +27,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"]
-[panel_group://workbench_panel_group_aws_suspicious_provisioning_activities]
-label = AWS Suspicious Provisioning Activities
-description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
-disabled = 0
-
-panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task"]
-
[panel_group://workbench_panel_group_aws_user_monitoring]
label = AWS User Monitoring
description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
@@ -139,13 +125,6 @@ disabled = 0
panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]
-[panel_group://workbench_panel_group_common_phishing_frameworks]
-label = Common Phishing Frameworks
-description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
-disabled = 0
-
-panels = ["panel://workbench_panel_domain_certificate_investigation___response_task", "panel://workbench_panel_get_certificate_logs_for_a_domain___response_task"]
-
[panel_group://workbench_panel_group_container_implantation_monitoring_and_investigation]
label = Container Implantation Monitoring and Investigation
description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
@@ -272,13 +251,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"]
-[panel_group://workbench_panel_group_host_redirection]
-label = Host Redirection
-description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task"]
-
[panel_group://workbench_panel_group_ingress_tool_transfer]
label = Ingress Tool Transfer
description = Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.
@@ -307,13 +279,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
-[panel_group://workbench_panel_group_kubernetes_sensitive_role_activity]
-label = Kubernetes Sensitive Role Activity
-description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_notable_history___response_task"]
-
[panel_group://workbench_panel_group_lateral_movement]
label = Lateral Movement
description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
@@ -342,20 +307,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
-[panel_group://workbench_panel_group_monitor_backup_solution]
-label = Monitor Backup Solution
-description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
-disabled = 0
-
-panels = ["panel://workbench_panel_all_backup_logs_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task"]
-
-[panel_group://workbench_panel_group_monitor_for_unauthorized_software]
-label = Monitor for Unauthorized Software
-description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]
-
[panel_group://workbench_panel_group_monitor_for_updates]
label = Monitor for Updates
description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.
@@ -468,34 +419,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
-[panel_group://workbench_panel_group_spectre_and_meltdown_vulnerabilities]
-label = Spectre And Meltdown Vulnerabilities
-description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_notable_history___response_task"]
-
-[panel_group://workbench_panel_group_splunk_enterprise_vulnerability]
-label = Splunk Enterprise Vulnerability
-description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_notable_history___response_task"]
-
-[panel_group://workbench_panel_group_splunk_enterprise_vulnerability_cve_2018_11409]
-label = Splunk Enterprise Vulnerability CVE-2018-11409
-description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"]
-
-[panel_group://workbench_panel_group_suspicious_aws_ec2_activities]
-label = Suspicious AWS EC2 Activities
-description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
-disabled = 0
-
-panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
-
[panel_group://workbench_panel_group_suspicious_aws_login_activities]
label = Suspicious AWS Login Activities
description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
@@ -643,13 +566,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task"]
-[panel_group://workbench_panel_group_unusual_aws_ec2_modifications]
-label = Unusual AWS EC2 Modifications
-description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
-disabled = 0
-
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"]
-
[panel_group://workbench_panel_group_unusual_processes]
label = Unusual Processes
description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
@@ -664,13 +580,6 @@ disabled = 0
panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]
-[panel_group://workbench_panel_group_web_fraud_detection]
-label = Web Fraud Detection
-description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
-disabled = 0
-
-panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"]
-
[panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350]
label = Windows DNS SIGRed CVE-2020-1350
description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 23ff0d0431..370f88d849 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:25 UTC
+# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -435,6 +435,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[allow_operation_with_consent_admin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[amazon_eks_kubernetes_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -511,6 +515,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[clear_unallocated_sector_using_cipher_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[clients_connecting_to_multiple_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -723,6 +731,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[detect_empire_with_powershell_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[detect_excessive_account_lockouts_from_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -783,6 +795,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[detect_mimikatz_with_powershell_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[detect_new_local_admin_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -967,6 +983,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[detect_wmi_event_subscription_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[detect_windows_dns_sigred_via_splunk_stream_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1023,6 +1043,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[disable_logs_using_wevtutil_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[disable_registry_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1175,6 +1199,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[excessive_number_of_taskhost_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1591,18 +1619,54 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[permission_modification_using_takeown_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[plain_http_post_exfiltrated_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[powershell_domain_enumeration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[powershell_start_bitstransfer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[powershell_creating_thread_mutex_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_fileless_process_injection_via_getprocaddress_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_fileless_script_contains_base64_encoded_content_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_processing_stream_of_data_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[powershell_remote_thread_to_known_windows_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[powershell_using_memory_as_backing_store_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[prevent_automatic_repair_mode_using_bcdedit_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[process_creating_lnk_file_in_suspicious_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1651,6 +1715,14 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[recon_avproduct_through_pwh_or_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[recon_using_wmi_class_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[reg_exe_manipulating_windows_services_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1827,6 +1899,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[start_up_during_safe_mode_boot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[sunburst_correlation_dll_and_network_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1859,6 +1935,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[suspicious_event_log_service_behavior_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[suspicious_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1991,6 +2071,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[unloading_amsi_via_reflection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[unsigned_image_loaded_by_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2027,6 +2111,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
+[wmi_recon_running_process_or_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
[wmi_temporary_event_subscription_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index 84184b0dc9..72654e77b7 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:24 UTC
+# On Date: 2021-06-24T18:00:37 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -10,10 +10,10 @@
[ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
@@ -34,12 +34,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule
+action.correlationsearch.label = ESCU - Deprecated - AWS Cloud Provisioning From Previously Unseen City - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen City
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
@@ -57,10 +57,10 @@ search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
[ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
@@ -76,12 +76,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule
+action.correlationsearch.label = ESCU - Deprecated - AWS Cloud Provisioning From Previously Unseen Country - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen Country
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
@@ -99,10 +99,10 @@ search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI
[ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
@@ -118,12 +118,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule
+action.correlationsearch.label = ESCU - Deprecated - AWS Cloud Provisioning From Previously Unseen IP Address - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "nist": ["ID.AM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen IP Address
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
@@ -141,10 +141,10 @@ search = `cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail`
[ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your region, there should be few false positives. If you are located in regions where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
@@ -160,12 +160,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule
+action.correlationsearch.label = ESCU - Deprecated - AWS Cloud Provisioning From Previously Unseen Region - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = AWS Cloud Provisioning From Previously Unseen Region
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
@@ -423,10 +423,10 @@ search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-e
[ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
action.escu.data_models = []
-action.escu.eli5 = This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
action.escu.how_to_implement = You must install Splunk Add-on for Amazon Web Services and Splunk App for AWS. This search works with cloudwatch logs.
action.escu.known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
action.escu.creation_date = 2020-06-23
@@ -441,11 +441,11 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule
+action.correlationsearch.label = ESCU - Deprecated - AWS EKS Kubernetes cluster sensitive object access - Rule
action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]}
schedule_window = auto
action.notable = 1
-action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets
action.notable.param.rule_title = AWS EKS Kubernetes cluster sensitive object access
action.notable.param.security_domain = threat
action.notable.param.severity = high
@@ -943,10 +943,10 @@ search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazona
[ESCU - Abnormally High AWS Instances Launched by User - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment.
action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-07-21
@@ -966,11 +966,11 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High AWS Instances Launched by User - Rule
+action.correlationsearch.label = ESCU - Deprecated - Abnormally High AWS Instances Launched by User - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
action.notable = 1
-action.notable.param.rule_description = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel
action.notable.param.rule_title = Abnormally High AWS Instances Launched by User
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -988,10 +988,10 @@ search = `cloudtrail` eventName=RunInstances errorCode=success | bucket span=10m
[ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment.
action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-07-21
@@ -1011,12 +1011,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule
+action.correlationsearch.label = ESCU - Deprecated - Abnormally High AWS Instances Launched by User - MLTK - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = Abnormally High AWS Instances Launched by User - MLTK
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -1034,10 +1034,10 @@ search = `cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_
[ESCU - Abnormally High AWS Instances Terminated by User - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
action.escu.known_false_positives = Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user.
action.escu.creation_date = 2020-07-21
@@ -1052,11 +1052,11 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High AWS Instances Terminated by User - Rule
+action.correlationsearch.label = ESCU - Deprecated - Abnormally High AWS Instances Terminated by User - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
action.notable = 1
-action.notable.param.rule_description = This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = Abnormally High AWS Instances Terminated by User
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -1074,10 +1074,10 @@ search = `cloudtrail` eventName=TerminateInstances errorCode=success | bucket sp
[ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. The threshold value should be tuned to your environment.
action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
action.escu.creation_date = 2020-07-21
@@ -1092,12 +1092,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule
+action.correlationsearch.label = ESCU - Deprecated - Abnormally High AWS Instances Terminated by User - MLTK - Rule
action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
action.notable.param.rule_title = Abnormally High AWS Instances Terminated by User - MLTK
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -1435,6 +1435,47 @@ realtime_schedule = 0
is_visible = false
search = `powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`
+[ESCU - Allow Operation with Consent Admin - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]}
+action.escu.data_models = []
+action.escu.eli5 = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2021-06-10
+action.escu.modification_date = 2021-06-10
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Allow Operation with Consent Admin - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Allow Operation with Consent Admin - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['dest']
+action.notable.param.rule_description = this search is to detect a potential privilege escalation attempt to do malicious task. This registry modification is designed to allows the Consent Admin to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine.
+action.notable.param.rule_title = Allow Operation with Consent Admin
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*" Registry.registry_key_name = ConsentPromptBehaviorAdmin Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `allow_operation_with_consent_admin_filter`
+
[ESCU - Amazon EKS Kubernetes Pod scan detection - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -2211,13 +2252,54 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter`
+[ESCU - Clear Unallocated Sector Using Cipher App - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files.
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = administrator may execute this app to manage disk
+action.escu.creation_date = 2021-06-10
+action.escu.modification_date = 2021-06-10
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Clear Unallocated Sector Using Cipher App - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Ransomware"]
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher App - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['user', 'dest']
+action.notable.param.rule_description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files.
+action.notable.param.rule_title = Clear Unallocated Sector Using Cipher App
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe" Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`
+
[ESCU - Clients Connecting to Multiple DNS Servers - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
action.escu.mappings = {"cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]}
action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
action.escu.how_to_implement = This search requires that DNS data is being ingested and populating the `Network_Resolution` data model. This data can come from DNS logs or from solutions that parse network traffic for this data, such as Splunk Stream or Bro.\
This search produces fields (`dest_count`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** Distinct DNS Connections, **Field:** dest_count\
Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
@@ -2234,12 +2316,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Clients Connecting to Multiple DNS Servers - Rule
+action.correlationsearch.label = ESCU - Deprecated - Clients Connecting to Multiple DNS Servers - Rule
action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['dest', 'src']
-action.notable.param.rule_description = This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to identify the endpoints that have connected to more than five DNS servers and made DNS Queries over the time frame of the search.
action.notable.param.rule_title = Clients Connecting to Multiple DNS Servers
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -2578,10 +2660,10 @@ search = | tstats `security_content_summariesonly` count earliest(_time) as firs
[ESCU - Cloud Network Access Control List Deleted - Rule]
action.escu = 0
action.escu.enabled = 1
-description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
action.escu.data_models = []
-action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You can also provide additional filtering for this search by customizing the `cloud_network_access_control_list_deleted_filter` macro.
action.escu.known_false_positives = It's possible that a user has legitimately deleted a network ACL.
action.escu.creation_date = 2020-09-08
@@ -2596,12 +2678,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Cloud Network Access Control List Deleted - Rule
+action.correlationsearch.label = ESCU - Deprecated - Cloud Network Access Control List Deleted - Rule
action.correlationsearch.annotations = {"analytic_story": ["Cloud Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['src']
-action.notable.param.rule_description = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
action.notable.param.rule_title = Cloud Network Access Control List Deleted
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -3377,13 +3459,13 @@ action.escu.full_search_name = ESCU - DNS Exfiltration Using Nslookup App - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"]
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user', 'dest']
@@ -3492,10 +3574,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Network_
[ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
action.escu.mappings = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
action.escu.how_to_implement = To successfully implement this search you will need to ensure that DNS data is populating the Network_Resolution data model. It also requires that your DNS servers are identified correctly in the Assets and Identity table of Enterprise Security.
action.escu.known_false_positives = Legitimate DNS activity can be detected in this search. Investigate, verify and update the list of authorized DNS servers as appropriate.
action.escu.creation_date = 2020-07-21
@@ -3510,12 +3592,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule
+action.correlationsearch.label = ESCU - Deprecated - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule
action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['dest', 'src']
-action.notable.param.rule_description = This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
action.notable.param.rule_title = DNS Query Requests Resolved by Unauthorized DNS Servers
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -3533,10 +3615,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Network_
[ESCU - DNS record changed - Rule]
action.escu = 0
action.escu.enabled = 1
-description = The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
action.escu.mappings = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
action.escu.how_to_implement = To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search "Discover DNS record". \
**Splunk>Phantom Playbook Integration**\
If Splunk>Phantom is also configured in your environment, a Playbook called "DNS Hijack Enrichment" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \
@@ -3555,12 +3637,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - DNS record changed - Rule
+action.correlationsearch.label = ESCU - Deprecated - DNS record changed - Rule
action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['src']
-action.notable.param.rule_description = The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
action.notable.param.rule_title = DNS record changed
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -3756,10 +3838,10 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces
[ESCU - Detect API activity from users without MFA - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
action.escu.mappings = {"cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Leverage the support search `Create a list of approved AWS service accounts`: run it once every 30 days to create a list of service accounts and validate them.\
This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\
1. \
@@ -3785,12 +3867,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Detect API activity from users without MFA - Rule
+action.correlationsearch.label = ESCU - Deprecated - Detect API activity from users without MFA - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
action.notable.param.rule_title = Detect API activity from users without MFA
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -3849,10 +3931,10 @@ search = `cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="ar
[ESCU - Detect AWS API Activities From Unapproved Accounts - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]}
action.escu.data_models = []
-action.escu.eli5 = This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You must also populate the `identity_lookup_expanded` lookup shipped with the Asset and Identity framework to be able to look up users in your identity table in Enterprise Security (ES). Leverage the support search called "Create a list of approved AWS service accounts": run it once every 30 days to create and validate a list of service accounts.\
This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not yet supported by ES Incident Review and therefore cannot be viewed when a notable event is raised. These fields contribute additional context to the notable. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\\n1. **Label:** AWS Event Name, **Field:** eventName\
1. \
@@ -3878,12 +3960,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Detect AWS API Activities From Unapproved Accounts - Rule
+action.correlationsearch.label = ESCU - Deprecated - Detect AWS API Activities From Unapproved Accounts - Rule
action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['user']
-action.notable.param.rule_description = This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
action.notable.param.rule_title = Detect AWS API Activities From Unapproved Accounts
action.notable.param.security_domain = access
action.notable.param.severity = high
@@ -4386,10 +4468,10 @@ search = `sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR G
[ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
+description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
action.escu.mappings = {"cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
+action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
action.escu.how_to_implement = You need to ingest data from your DNS logs in the Network_Resolution datamodel. Specifically you must ingest the domain that is being queried and the IP of the host originating the request. Ideally, you should also be ingesting the answer to the query and the query type. This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You will have to add legitimate domain names to the `legit_domains.csv` file shipped with the app. \
**Splunk>Phantom Playbook Integration**\
If Splunk>Phantom is also configured in your environment, a Playbook called `Lets Encrypt Domain Investigate` can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \
@@ -4408,12 +4490,12 @@ cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule
+action.correlationsearch.label = ESCU - Deprecated - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule
action.correlationsearch.annotations = {"analytic_story": ["Common Phishing Frameworks"], "cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = ['dest', 'src']
-action.notable.param.rule_description = This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
+action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
action.notable.param.rule_title = Detect DNS requests to Phishing Sites leveraging EvilGinx2
action.notable.param.security_domain = network
action.notable.param.severity = high
@@ -4428,6 +4510,52 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution.DNS by DNS.dest DNS.src DNS.query host | `drop_dm_object_name(DNS)`| rex field=query ".*?(?Add Prohibited Processes to Enterprise Security.
annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
known_false_positives = None identified
@@ -4861,6 +4875,26 @@ annotations = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]}
known_false_positives = unknown
providing_technologies = []
+[savedsearch://ESCU - Recon AVProduct Through Pwh or WMI - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+known_false_positives = network administrator may used this command for checking purposes
+providing_technologies = []
+
+[savedsearch://ESCU - Recon Using WMI Class - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+known_false_positives = network administrator may used this command for checking purposes
+providing_technologies = []
+
[savedsearch://ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule]
type = detection
asset_type = Endpoint
@@ -4875,7 +4909,7 @@ providing_technologies = []
type = detection
asset_type =
confidence = medium
-explanation = The search looks for command-line arguments used to hide a file or directory using the reg add command.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for command-line arguments used to hide a file or directory using the reg add command.
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]}
known_false_positives = None at the moment
@@ -4955,7 +4989,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search monitors for remote modifications to registry keys.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search monitors for remote modifications to registry keys.
how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out.
@@ -4965,10 +4999,10 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for wmic.exe being launched with parameters to operate on remote systems.
+explanation = The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. Deprecated because duplicate of Remote Process Instantiation via WMI.
annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
-known_false_positives = Administrators may use this legitimately to gather info from remote systems.
+known_false_positives = Administrators may use this legitimately to gather info from remote systems. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Resize ShadowStorage volume - Rule]
@@ -5148,7 +5182,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]}
known_false_positives = No known false positives
@@ -5191,7 +5225,7 @@ confidence = medium
explanation = This search looks for scripts launched via WMI.
how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
-known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.
+known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule]
@@ -5278,7 +5312,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
how_to_implement = The search requires that you are ingesting your vulnerability-scanner data and that it reports the CVE of the vulnerability identified.
annotations = {"cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]}
known_false_positives = It is possible that your vulnerability scanner is not detecting that the patches have been applied.
@@ -5298,12 +5332,22 @@ providing_technologies = []
type = detection
asset_type = Splunk Server
confidence = medium
-explanation = This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
how_to_implement = The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Whitelisting your Splunk systems will reduce false positives.
annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]}
known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information.
providing_technologies = []
+[savedsearch://ESCU - Start Up During Safe Mode Boot - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot.
+how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]}
+known_false_positives = updated windows application needed in safe boot may used this registry
+providing_technologies = []
+
[savedsearch://ESCU - Sunburst Correlation DLL and Network Event - Rule]
type = detection
asset_type = Windows
@@ -5328,7 +5372,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
how_to_implement = To successfully implement this search you need to be ingesting information on registry changes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` nodes.
annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
known_false_positives = There may be other processes in your environment that users may legitimately use to modify file associations. If this is the case and you are finding false positives, you can modify the search to add those processes as exceptions.
@@ -5368,7 +5412,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).
how_to_implement = You must be ingesting data from email logs and have Splunk integrated with UBA. This anomaly is raised by a UBA detection model called "SuspiciousEmailDetectionModel." Ensure that this model is enabled on your UBA instance.
annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]}
known_false_positives = This detection model will alert on any sender domain that is seen for the first time. This could be a potential false positive. The next step is to investigate and add the URL to an allow list if you determine that it is a legitimate sender.
@@ -5386,11 +5430,21 @@ annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Del
known_false_positives = None identified
providing_technologies = []
+[savedsearch://ESCU - Suspicious Event Log Service Behavior - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
+known_false_positives = It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed.
+providing_technologies = []
+
[savedsearch://ESCU - Suspicious File Write - Rule]
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search looks for files created with names that have been linked to malicious activity.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for files created with names that have been linked to malicious activity.
how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate.
@@ -5634,7 +5688,7 @@ providing_technologies = []
type = detection
asset_type = Windows
confidence = medium
-explanation = This search detects writes to the 'System Volume Information' folder by something other than the System process.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects writes to the 'System Volume Information' folder by something other than the System process.
how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
annotations = {"cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]}
known_false_positives = It is possible that other utilities or system processes may legitimately write to this folder. Investigate and modify the search to include exceptions as appropriate.
@@ -5706,7 +5760,7 @@ providing_technologies = []
type = detection
asset_type =
confidence = medium
-explanation = This search looks for applications on the endpoint that you have marked as uncommon.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for applications on the endpoint that you have marked as uncommon.
how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search uses a lookup file `uncommon_processes_default.csv` to track various features of process names that are usually uncommon in most environments. Please consider updating `uncommon_processes_local.csv` to hunt for processes that are uncommon in your environment.
annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]}
known_false_positives = None identified
@@ -5732,11 +5786,23 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"
known_false_positives =
providing_technologies = []
+[savedsearch://ESCU - Unloading AMSI via Reflection - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies the behavior of AMSI being tampered with. Implemented natively in many frameworks, the command will look similar to `SEtValuE($Null,(New-OBJEct COLlECtionS.GenerIC.HAshSEt[StrINg]))}$ReF=[ReF].AsSeMbLY.GeTTyPe("System.Management.Automation.Amsi"+"Utils")` taken from Powershell-Empire. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]}
+known_false_positives = Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
+providing_technologies = []
+
[savedsearch://ESCU - Unsigned Image Loaded by LSASS - Rule]
type = detection
asset_type = Windows
confidence = medium
-explanation = This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
how_to_implement = This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]}
known_false_positives = Other tools could load images into LSASS for legitimate reason. But enterprise tools should always use signed DLLs.
@@ -5746,7 +5812,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search gives you the hosts where a backup was attempted and then failed.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search gives you the hosts where a backup was attempted and then failed.
how_to_implement = To successfully implement this search you need to obtain data from your backup solution, either from the backup logs on your endpoints or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your specific backup solution.
annotations = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
known_false_positives = None identified
@@ -5816,12 +5882,27 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for the creation of WMI permanent event subscriptions.
-how_to_implement = To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
+explanation = This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.
+All event subscriptions have three components \
+1. Filter - WQL Query for the events we want. EventID = 19 \
+1. Consumer - An action to take upon triggering the filter. EventID = 20 \
+1. Binding - Registers a filter to a consumer. EventID = 21 \
+Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription.
+how_to_implement = To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes.
providing_technologies = []
+[savedsearch://ESCU - WMI Recon Running Process Or Services - Rule]
+type = detection
+asset_type =
+confidence = medium
+explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+known_false_positives = network administrator may used this command for checking purposes
+providing_technologies = []
+
[savedsearch://ESCU - WMI Temporary Event Subscription - Rule]
type = detection
asset_type = Endpoint
@@ -5846,7 +5927,7 @@ providing_technologies = []
type = detection
asset_type = Account
confidence = medium
-explanation = This search is used to identify the creation of multiple user accounts using the same email domain name.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to identify the creation of multiple user accounts using the same email domain name.
how_to_implement = We start with a dataset that provides visibility into the email address used for the account creation. In this example, we are narrowing our search down to the single web page that hosts the Magento2 e-commerce platform (via URI) used for account creation, the single http content-type to grab only the user's clicks, and the http field that provides the username (form_data), for performance reasons. After we have the username and email domain, we look for numerous account creations per email domain. Common data sources used for this detection are customized Apache logs or Splunk Stream.
annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]}
known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamolous behavior. This search will need to be customized to fit your environment—improving its fidelity by counting based on something much more specific, such as a device ID that may be present in your dataset. Consideration for whether the large number of registrations are occuring from a first-time seen domain may also be important. Extending the search window to look further back in time, or even calculating the average per hour/day for each email domain to look for an anomalous spikes, will improve this search. You can also use Shannon entropy or Levenshtein Distance (both courtesy of URL Toolbox) to consider the randomness or similarity of the email name or email domain, as the names are often machine-generated.
@@ -5856,7 +5937,7 @@ providing_technologies = []
type = detection
asset_type = account
confidence = medium
-explanation = This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
how_to_implement = Start with a dataset that allows you to see clickstream data for each user click on the website. That data must have a time stamp and must contain a reference to the session identifier being used by the website. This ties the clicks together into clickstreams. This value is usually found in the http cookie. With a bit of tuning, a version of this search could be used in high-volume scenarios, such as scraping, crawling, application DDOS, credit-card testing, account takeover, etc. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.
annotations = {"cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]}
known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosly written detections that simply detect anamoluous behavior.
@@ -5866,7 +5947,7 @@ providing_technologies = []
type = detection
asset_type = account
confidence = medium
-explanation = This search is used to identify user accounts that share a common password.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search is used to identify user accounts that share a common password.
how_to_implement = We need to start with a dataset that allows us to see the values of usernames and passwords that users are submitting to the website hosting the Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized or hashed value of a password is acceptable and certainly preferable to a clear-text password. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.
annotations = {"cis20": ["CIS 16"], "nist": ["DE.DP"]}
known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior.
@@ -5974,10 +6055,10 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = This search looks for Windows events that indicate one of the Windows event logs has been purged.
-how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts.
+explanation = The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
-known_false_positives = It is possible that these logs may be legitimately cleared by Administrators.
+known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
providing_technologies = []
[savedsearch://ESCU - Windows Security Account Manager Stopped - Rule]
@@ -5994,7 +6075,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
how_to_implement = You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = This process should not be ran forcefully, we have not see any false positives for this detection
@@ -6004,7 +6085,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
-explanation = The search looks for modifications to the hosts file on all Windows endpoints across your environment.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. The search looks for modifications to the hosts file on all Windows endpoints across your environment.
how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
annotations = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]}
known_false_positives = There may be legitimate reasons for system administrators to add entries to this file.
@@ -6114,7 +6195,7 @@ providing_technologies = []
type = detection
asset_type = GCP Account
confidence = medium
-explanation = This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally.
+explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally.
how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
annotations = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]}
known_false_positives = GCP Oauth token abuse detection will only work if there are access policies in place along with audit logs.
diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest
index 88798c4113..66717fdb3c 100644
--- a/dist/saaws/app.manifest
+++ b/dist/saaws/app.manifest
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS_AmazonWebServices_Content",
- "version": "3.23.0"
+ "version": "3.24.0"
},
"author": [
{
diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf
index 87da377997..79856b4d51 100644
--- a/dist/saaws/default/analytic_stories.conf
+++ b/dist/saaws/default/analytic_stories.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf
index 42086a2e5b..b25af82b9d 100644
--- a/dist/saaws/default/analyticstories.conf
+++ b/dist/saaws/default/analyticstories.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf
index 96528ffe88..7f5a2a9139 100644
--- a/dist/saaws/default/app.conf
+++ b/dist/saaws/default/app.conf
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
-build = 30583
+build = 32018
[triggers]
reload.analytic_stories = simple
@@ -18,7 +18,7 @@ reload.content-version = simple
[launcher]
author = Splunk
-version = 3.23.0
+version = 3.24.0
description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content
[ui]
diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf
index a158d45299..03d7f85f2e 100644
--- a/dist/saaws/default/collections.conf
+++ b/dist/saaws/default/collections.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/saaws/default/content-version.conf b/dist/saaws/default/content-version.conf
index 80a526948d..e01cb50393 100644
--- a/dist/saaws/default/content-version.conf
+++ b/dist/saaws/default/content-version.conf
@@ -1,2 +1,2 @@
[content-version]
-version = 3.23.0
+version = 3.24.0
diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf
index b625f2de7f..da30ca8629 100644
--- a/dist/saaws/default/macros.conf
+++ b/dist/saaws/default/macros.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf
index 080a42b71d..039371aa3a 100644
--- a/dist/saaws/default/savedsearches.conf
+++ b/dist/saaws/default/savedsearches.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf
index e5c6e4b651..faa63c922c 100644
--- a/dist/saaws/default/transforms.conf
+++ b/dist/saaws/default/transforms.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf
index 42086a2e5b..b25af82b9d 100644
--- a/dist/saaws/default/use_case_library.conf
+++ b/dist/saaws/default/use_case_library.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-06-10T18:24:49 UTC
+# On Date: 2021-06-24T18:00:54 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/docs/detections.md b/docs/detections.md
index 257e47fe05..8c3ab519c0 100644
--- a/docs/detections.md
+++ b/docs/detections.md
@@ -9,14 +9,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
- [AWS Create Policy Version to allow all resources](#aws-create-policy-version-to-allow-all-resources)
@@ -41,8 +33,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [AWS Excessive Security Scanning](#aws-excessive-security-scanning)
@@ -91,14 +81,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
- [Abnormally High Number Of Cloud Infrastructure API Calls](#abnormally-high-number-of-cloud-infrastructure-api-calls)
@@ -123,6 +105,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+
+
- [Amazon EKS Kubernetes Pod scan detection](#amazon-eks-kubernetes-pod-scan-detection)
@@ -203,8 +187,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Cloud Provisioning Activity From Previously Unseen City](#cloud-provisioning-activity-from-previously-unseen-city)
@@ -276,14 +258,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
@@ -362,8 +336,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
@@ -445,8 +417,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Detect Spike in AWS Security Hub Alerts for EC2 Instance](#detect-spike-in-aws-security-hub-alerts-for-ec2-instance)
@@ -455,14 +425,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Detect Spike in S3 Bucket deletion](#detect-spike-in-s3-bucket-deletion)
-
-
- [Detect Spike in blocked Outbound Traffic from your AWS](#detect-spike-in-blocked-outbound-traffic-from-your-aws)
@@ -562,28 +528,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -609,10 +553,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
- [GCP Kubernetes cluster pod scan detection](#gcp-kubernetes-cluster-pod-scan-detection)
@@ -625,8 +565,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [High Number of Login Failures from a single source](#high-number-of-login-failures-from-a-single-source)
@@ -652,16 +590,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
@@ -706,38 +634,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -1128,18 +1024,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
@@ -1172,8 +1056,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
- [aws detect sts get session token abuse](#aws-detect-sts-get-session-token-abuse)
-
-
## Endpoint
@@ -1207,24 +1089,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -1260,6 +1124,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+- [Allow Operation with Consent Admin](#allow-operation-with-consent-admin)
+
+
+
@@ -1348,6 +1216,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+- [Clear Unallocated Sector Using Cipher App](#clear-unallocated-sector-using-cipher-app)
+
- [Clop Common Exec Parameter](#clop-common-exec-parameter)
@@ -1375,8 +1245,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
@@ -1484,10 +1352,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
- [DSQuery Domain Discovery](#dsquery-domain-discovery)
@@ -1514,10 +1378,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
- [Detect Activity Related to Pass the Hash Attacks](#detect-activity-related-to-pass-the-hash-attacks)
@@ -1550,12 +1410,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Detect Dump LSASS Memory using comsvcs](#detect-dump-lsass-memory-using-comsvcs)
+- [Detect Empire with PowerShell Script Block Logging](#detect-empire-with-powershell-script-block-logging)
+
+
+
- [Detect Excessive Account Lockouts From Endpoint](#detect-excessive-account-lockouts-from-endpoint)
@@ -1596,8 +1458,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Detect MSHTA Url in Command Line](#detect-mshta-url-in-command-line)
@@ -1606,6 +1466,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+- [Detect Mimikatz With PowerShell Script Block Logging](#detect-mimikatz-with-powershell-script-block-logging)
+
- [Detect New Local Admin account](#detect-new-local-admin-account)
@@ -1743,14 +1605,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
@@ -1760,6 +1614,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+- [Detect WMI Event Subscription Persistence](#detect-wmi-event-subscription-persistence)
+
+
+
@@ -1780,22 +1638,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
- [Detect processes used for System Network Configuration Discovery](#detect-processes-used-for-system-network-configuration-discovery)
-
-
-
-
- [Detection of tools built by NirSoft](#detection-of-tools-built-by-nirsoft)
+- [Disable Logs Using WevtUtil](#disable-logs-using-wevtutil)
+
+
+
- [Disable Registry Tool](#disable-registry-tool)
@@ -1874,16 +1728,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
- [Enable RDP In Other Port Number](#enable-rdp-in-other-port-number)
@@ -1930,6 +1774,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+- [Excessive number of distinct processes created in Windows Temp folder](#excessive-number-of-distinct-processes-created-in-windows-temp-folder)
+
+
+
- [Excessive number of taskhost processes](#excessive-number-of-taskhost-processes)
@@ -1938,14 +1786,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Execution of File with Multiple Extensions](#execution-of-file-with-multiple-extensions)
-
-
- [Extract SAM from Registry](#extract-sam-from-registry)
@@ -1966,8 +1810,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [FodHelper UAC Bypass](#fodhelper-uac-bypass)
@@ -1976,14 +1818,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
- [GPUpdate with no Command Line Arguments with Network](#gpupdate-with-no-command-line-arguments-with-network)
@@ -2016,8 +1850,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Illegal Access To User Content via PowerSploit modules](#illegal-access-to-user-content-via-powersploit-modules)
@@ -2070,42 +1902,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- [MacOS - Re-opened Applications](#macos---re-opened-applications)
@@ -2126,8 +1922,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Malicious PowerShell Process With Obfuscation Techniques](#malicious-powershell-process-with-obfuscation-techniques)
@@ -2146,8 +1940,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Monitor Registry Keys for Print Monitors](#monitor-registry-keys-for-print-monitors)
@@ -2274,26 +2066,58 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
- [Overwriting Accessibility Binaries](#overwriting-accessibility-binaries)
+- [Permission Modification using Takeown App](#permission-modification-using-takeown-app)
+
+
+
+- [PowerShell Domain Enumeration](#powershell-domain-enumeration)
+
+
+
+- [PowerShell Loading DotNET into Memory via System Reflection Assembly](#powershell-loading-dotnet-into-memory-via-system-reflection-assembly)
+
+
+
- [PowerShell Start-BitsTransfer](#powershell-start-bitstransfer)
+- [Powershell Creating Thread Mutex](#powershell-creating-thread-mutex)
+
+
+
+- [Powershell Fileless Process Injection via GetProcAddress](#powershell-fileless-process-injection-via-getprocaddress)
+
+
+
+- [Powershell Fileless Script Contains Base64 Encoded Content](#powershell-fileless-script-contains-base64-encoded-content)
+
+
+
+- [Powershell Processing Stream Of Data](#powershell-processing-stream-of-data)
+
+
+
- [Powershell Remote Thread To Known Windows Process](#powershell-remote-thread-to-known-windows-process)
+- [Powershell Using memory As Backing Store](#powershell-using-memory-as-backing-store)
+
+
+
+- [Prevent Automatic Repair Mode using Bcdedit](#prevent-automatic-repair-mode-using-bcdedit)
+
+
+
- [Probing Access with Stolen Credentials via PowerSploit modules](#probing-access-with-stolen-credentials-via-powersploit-modules)
@@ -2318,8 +2142,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Processes launching netsh](#processes-launching-netsh)
@@ -2330,12 +2152,20 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Ransomware Notes bulk creation](#ransomware-notes-bulk-creation)
+- [Rare Parent-Child Process Relationship](#rare-parent-child-process-relationship)
+
+
+
+- [Recon AVProduct Through Pwh or WMI](#recon-avproduct-through-pwh-or-wmi)
+
+
+
+- [Recon Using WMI Class](#recon-using-wmi-class)
+
- [Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules](#reconnaissance-and-access-to-accounts-groups-and-policies-via-powersploit-modules)
@@ -2402,8 +2232,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Registry Keys Used For Persistence](#registry-keys-used-for-persistence)
@@ -2428,7 +2256,7 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
+- [Remote WMI Command Attempt](#remote-wmi-command-attempt)
@@ -2494,8 +2322,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Schtasks Run Task On Demand](#schtasks-run-task-on-demand)
@@ -2556,12 +2382,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Spike in File Writes](#spike-in-file-writes)
+- [Start Up During Safe Mode Boot](#start-up-during-safe-mode-boot)
+
- [Sunburst Correlation DLL and Network Event](#sunburst-correlation-dll-and-network-event)
@@ -2570,8 +2396,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Suspicious Curl Network Connection](#suspicious-curl-network-connection)
@@ -2586,7 +2410,7 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
+- [Suspicious Event Log Service Behavior](#suspicious-event-log-service-behavior)
@@ -2676,8 +2500,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Suspicious writes to windows Recycle Bin](#suspicious-writes-to-windows-recycle-bin)
@@ -2704,8 +2526,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Unified Messaging Service Spawning a Process](#unified-messaging-service-spawning-a-process)
@@ -2714,7 +2534,7 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
+- [Unloading AMSI via Reflection](#unloading-amsi-via-reflection)
@@ -2748,6 +2568,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+- [WMI Recon Running Process Or Services](#wmi-recon-running-process-or-services)
+
+
+
- [WMI Temporary Event Subscription](#wmi-temporary-event-subscription)
@@ -2758,12 +2582,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
- [Wermgr Process Connecting To IP Check Web Services](#wermgr-process-connecting-to-ip-check-web-services)
@@ -2804,10 +2622,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
- [Winword Spawning Cmd](#winword-spawning-cmd)
@@ -2837,8 +2651,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
## Network
@@ -3004,24 +2816,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -3057,12 +2851,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
- [Detect ARP Poisoning](#detect-arp-poisoning)
@@ -3110,8 +2898,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
@@ -3140,8 +2926,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Detect Outbound SMB Traffic](#detect-outbound-smb-traffic)
@@ -3225,24 +3009,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
- [Detect Traffic Mirroring](#detect-traffic-mirroring)
-
-
- [Detect Unauthorized Assets by MAC address](#detect-unauthorized-assets-by-mac-address)
+
+
- [Detect Windows DNS SIGRed via Splunk Stream](#detect-windows-dns-sigred-via-splunk-stream)
@@ -3310,22 +3088,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -3380,18 +3142,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
@@ -3426,44 +3176,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -3502,10 +3214,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
@@ -3592,8 +3300,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
@@ -3614,6 +3320,20 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -3625,8 +3345,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Protocol or Port Mismatch](#protocol-or-port-mismatch)
@@ -3676,6 +3394,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+
+
@@ -3708,8 +3428,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
@@ -3822,16 +3540,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
@@ -3860,10 +3568,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
@@ -3915,16 +3619,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
@@ -4173,34 +3867,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -4349,28 +4015,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -4495,60 +4139,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -4670,8 +4260,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
- [Phishing Email Detection by Machine Learning Method - SSA](#phishing-email-detection-by-machine-learning-method---ssa)
@@ -4843,6 +4431,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+
+
+
+
@@ -4931,16 +4523,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
@@ -4988,12 +4570,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
@@ -5212,32 +4788,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -5372,14 +4922,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
@@ -5546,76 +5088,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -5824,6 +5296,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by
+
+
+
+
+
+
+
+
+
+
@@ -5880,10 +5362,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
@@ -6009,26 +5487,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -6055,294 +5513,6 @@ All the detections shipped to different Splunk products. Below is a breakdown by
-### AWS Cloud Provisioning From Previously Unseen City
-This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
-
-- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**:
-- **ATT&CK**: [T1535](https://attack.mitre.org/techniques/T1535/)
-- **Last Updated**: 2018-03-16
-
-Add Prohibited Processes to Enterprise Security.
-
-#### Required field
-
-* _times
-
-
-
-
-#### Kill Chain Phase
-
-* Installation
-
-* Command and Control
-
-* Actions on Objectives
-
-
-#### Known False Positives
-None identified
-
-#### Reference
-
-
-#### Test Dataset
-
-
_version_: 2
Add Prohibited Processes to Enterprise Security.
-
-====Required field====
-
-* _times
-
-
-
-
-====Kill Chain Phase====
-
-* Installation
-
-* Command and Control
-
-* Actions on Objectives
-
-
-====Known False Positives====
-None identified
-
-====Reference====
-
-
-====Test Dataset====
-
-
-''version'': 2
-############# # Automatically generated by doc_gen.py in https://github.com/splunk/security_content'' -# On Date: 2021-06-10 18:37:21.829243 UTC'' +# On Date: 2021-06-24 18:14:07.310619 UTC'' # Author: Splunk Security Research'' # Contact: research@splunk.com'' ############# diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index cd158ff29c..245ef83f89 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -12,9 +12,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -41,25 +41,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -139,9 +143,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -250,11 +254,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -278,9 +282,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -306,20 +311,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -419,14 +425,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -441,11 +450,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -494,11 +504,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -522,8 +533,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -593,11 +604,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -605,15 +617,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -632,7 +650,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -714,7 +733,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -758,14 +777,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -804,7 +824,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -899,7 +919,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -1015,12 +1035,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -1064,9 +1085,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -1093,25 +1114,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -1191,9 +1216,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -1302,11 +1327,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -1330,9 +1355,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -1358,20 +1384,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -1471,14 +1498,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -1493,11 +1523,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -1546,11 +1577,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -1574,8 +1606,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -1645,11 +1677,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -1657,15 +1690,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -1684,7 +1723,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -1766,7 +1806,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -1810,14 +1850,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -1856,7 +1897,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -1951,7 +1992,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -2067,12 +2108,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -2116,9 +2158,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -2145,25 +2187,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -2243,9 +2289,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -2354,11 +2400,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -2382,9 +2428,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -2410,20 +2457,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -2523,14 +2571,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -2545,11 +2596,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -2598,11 +2650,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -2626,8 +2679,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -2697,11 +2750,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -2709,15 +2763,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -2736,7 +2796,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -2818,7 +2879,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -2862,14 +2923,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -2908,7 +2970,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -3003,7 +3065,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -3119,12 +3181,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -3168,9 +3231,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -3197,25 +3260,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -3295,9 +3362,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -3406,11 +3473,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -3434,9 +3501,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -3462,20 +3530,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -3575,14 +3644,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -3597,11 +3669,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -3650,11 +3723,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -3678,8 +3752,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -3749,11 +3823,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -3761,15 +3836,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -3788,7 +3869,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -3870,7 +3952,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -3914,14 +3996,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -3960,7 +4043,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -4055,7 +4138,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -4171,12 +4254,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -4220,9 +4304,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -4249,25 +4333,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -4347,9 +4435,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -4458,11 +4546,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -4486,9 +4574,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -4514,20 +4603,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -4627,14 +4717,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -4649,11 +4742,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -4702,11 +4796,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -4730,8 +4825,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -4801,11 +4896,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -4813,15 +4909,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -4840,7 +4942,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -4922,7 +5025,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -4966,14 +5069,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -5012,7 +5116,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -5107,7 +5211,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -5223,12 +5327,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -5272,9 +5377,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -5301,25 +5406,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -5399,9 +5508,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -5510,11 +5619,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -5538,9 +5647,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -5566,20 +5676,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -5679,14 +5790,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -5701,11 +5815,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -5754,11 +5869,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -5782,8 +5898,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -5853,11 +5969,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -5865,15 +5982,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -5892,7 +6015,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -5974,7 +6098,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -6018,14 +6142,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -6064,7 +6189,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -6159,7 +6284,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -6275,12 +6400,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -6324,9 +6450,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -6353,25 +6479,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -6451,9 +6581,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -6562,11 +6692,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -6590,9 +6720,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -6618,20 +6749,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -6731,14 +6863,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -6753,11 +6888,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -6806,11 +6942,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -6834,8 +6971,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -6905,11 +7042,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -6917,15 +7055,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -6944,7 +7088,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -7026,7 +7171,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -7070,14 +7215,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -7116,7 +7262,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -7211,7 +7357,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -7327,12 +7473,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -7376,9 +7523,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -7405,25 +7552,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -7503,9 +7654,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -7614,11 +7765,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -7642,9 +7793,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -7670,20 +7822,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -7783,14 +7936,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -7805,11 +7961,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -7858,11 +8015,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -7886,8 +8044,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -7957,11 +8115,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -7969,15 +8128,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -7996,7 +8161,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -8078,7 +8244,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -8122,14 +8288,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -8168,7 +8335,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -8263,7 +8430,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -8379,12 +8546,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -8428,9 +8596,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -8457,25 +8625,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -8555,9 +8727,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -8666,11 +8838,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -8694,9 +8866,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -8722,20 +8895,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -8835,14 +9009,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -8857,11 +9034,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -8910,11 +9088,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -8938,8 +9117,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -9009,11 +9188,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -9021,15 +9201,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -9048,7 +9234,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -9130,7 +9317,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -9174,14 +9361,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -9220,7 +9408,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -9315,7 +9503,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -9431,12 +9619,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -9480,9 +9669,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -9509,25 +9698,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -9607,9 +9800,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -9718,11 +9911,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -9746,9 +9939,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -9774,20 +9968,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -9887,14 +10082,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -9909,11 +10107,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -9962,11 +10161,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -9990,8 +10190,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -10061,11 +10261,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -10073,15 +10274,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -10100,7 +10307,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -10182,7 +10390,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -10226,14 +10434,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -10272,7 +10481,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -10367,7 +10576,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -10483,12 +10692,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -10532,9 +10742,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -10561,25 +10771,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -10659,9 +10873,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -10770,11 +10984,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -10798,9 +11012,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -10826,20 +11041,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -10939,14 +11155,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -10961,11 +11180,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -11014,11 +11234,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -11042,8 +11263,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -11113,11 +11334,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -11125,15 +11347,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -11152,7 +11380,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -11234,7 +11463,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -11278,14 +11507,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -11324,7 +11554,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -11419,7 +11649,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -11535,12 +11765,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -11584,9 +11815,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -11613,25 +11844,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -11711,9 +11946,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -11822,11 +12057,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -11850,9 +12085,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -11878,20 +12114,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -11991,14 +12228,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -12013,11 +12253,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -12066,11 +12307,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -12094,8 +12336,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -12165,11 +12407,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -12177,15 +12420,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -12204,7 +12453,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -12286,7 +12536,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -12330,14 +12580,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -12376,7 +12627,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -12471,7 +12722,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -12587,12 +12838,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -12636,9 +12888,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -12665,25 +12917,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -12763,9 +13019,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -12874,11 +13130,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -12902,9 +13158,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -12930,20 +13187,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -13043,14 +13301,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -13065,11 +13326,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -13118,11 +13380,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -13146,8 +13409,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -13217,11 +13480,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -13229,15 +13493,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -13256,7 +13526,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -13338,7 +13609,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -13382,14 +13653,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -13428,7 +13700,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -13523,7 +13795,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -13639,12 +13911,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -13688,9 +13961,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -13717,25 +13990,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -13815,9 +14092,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -13926,11 +14203,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -13954,9 +14231,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -13982,20 +14260,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -14095,14 +14374,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -14117,11 +14399,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -14170,11 +14453,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -14198,8 +14482,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -14269,11 +14553,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -14281,15 +14566,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -14308,7 +14599,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -14390,7 +14682,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -14434,14 +14726,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -14480,7 +14773,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -14575,7 +14868,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -14691,12 +14984,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -14740,9 +15034,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -14769,25 +15063,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -14867,9 +15165,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -14978,11 +15276,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -15006,9 +15304,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -15034,20 +15333,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -15147,14 +15447,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -15169,11 +15472,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -15222,11 +15526,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -15250,8 +15555,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -15321,11 +15626,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -15333,15 +15639,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -15360,7 +15672,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -15442,7 +15755,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -15486,14 +15799,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -15532,7 +15846,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -15627,7 +15941,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -15743,12 +16057,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -15792,9 +16107,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -15821,25 +16136,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -15919,9 +16238,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -16030,11 +16349,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -16058,9 +16377,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -16086,20 +16406,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -16199,14 +16520,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -16221,11 +16545,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -16274,11 +16599,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -16302,8 +16628,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -16373,11 +16699,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -16385,15 +16712,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -16412,7 +16745,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -16494,7 +16828,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -16538,14 +16872,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -16584,7 +16919,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -16679,7 +17014,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -16795,12 +17130,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -16844,9 +17180,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -16873,25 +17209,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -16971,9 +17311,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -17082,11 +17422,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -17110,9 +17450,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -17138,20 +17479,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -17251,14 +17593,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -17273,11 +17618,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -17326,11 +17672,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -17354,8 +17701,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -17425,11 +17772,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -17437,15 +17785,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -17464,7 +17818,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -17546,7 +17901,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -17590,14 +17945,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -17636,7 +17992,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -17731,7 +18087,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -17847,12 +18203,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -17896,9 +18253,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -17925,25 +18282,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -18023,9 +18384,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -18134,11 +18495,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -18162,9 +18523,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -18190,20 +18552,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -18303,14 +18666,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -18325,11 +18691,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -18378,11 +18745,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -18406,8 +18774,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -18477,11 +18845,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -18489,15 +18858,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -18516,7 +18891,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -18598,7 +18974,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -18642,14 +19018,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -18688,7 +19065,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -18783,7 +19160,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -18899,12 +19276,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -18948,9 +19326,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -18977,25 +19355,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -19075,9 +19457,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -19186,11 +19568,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -19214,9 +19596,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -19242,20 +19625,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -19355,14 +19739,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -19377,11 +19764,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -19430,11 +19818,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -19458,8 +19847,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -19529,11 +19918,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -19541,15 +19931,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -19568,7 +19964,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -19650,7 +20047,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -19694,14 +20091,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -19740,7 +20138,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -19835,7 +20233,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -19951,12 +20349,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -20000,9 +20399,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -20029,25 +20428,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -20127,9 +20530,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -20238,11 +20641,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -20266,9 +20669,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -20294,20 +20698,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -20407,14 +20812,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -20429,11 +20837,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -20482,11 +20891,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -20510,8 +20920,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -20581,11 +20991,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -20593,15 +21004,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -20620,7 +21037,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -20702,7 +21120,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -20746,14 +21164,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -20792,7 +21211,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -20887,7 +21306,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -21003,12 +21422,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -21052,9 +21472,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -21081,25 +21501,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -21179,9 +21603,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -21290,11 +21714,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -21318,9 +21742,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -21346,20 +21771,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -21459,14 +21885,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -21481,11 +21910,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -21534,11 +21964,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -21562,8 +21993,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -21633,11 +22064,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -21645,15 +22077,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -21672,7 +22110,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -21754,7 +22193,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -21798,14 +22237,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -21844,7 +22284,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -21939,7 +22379,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -22055,12 +22495,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -22104,9 +22545,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -22133,25 +22574,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -22231,9 +22676,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -22342,11 +22787,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -22370,9 +22815,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -22398,20 +22844,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -22511,14 +22958,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -22533,11 +22983,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -22586,11 +23037,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -22614,8 +23066,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -22685,11 +23137,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -22697,15 +23150,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -22724,7 +23183,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -22806,7 +23266,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -22850,14 +23310,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -22896,7 +23357,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -22991,7 +23452,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -23107,12 +23568,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -23156,9 +23618,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -23185,25 +23647,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -23283,9 +23749,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -23394,11 +23860,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -23422,9 +23888,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -23450,20 +23917,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -23563,14 +24031,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -23585,11 +24056,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -23638,11 +24110,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -23666,8 +24139,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -23737,11 +24210,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -23749,15 +24223,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -23776,7 +24256,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -23858,7 +24339,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -23902,14 +24383,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -23948,7 +24430,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -24043,7 +24525,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -24159,12 +24641,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -24208,9 +24691,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -24237,25 +24720,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -24335,9 +24822,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -24446,11 +24933,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -24474,9 +24961,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -24502,20 +24990,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -24615,14 +25104,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -24637,11 +25129,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -24690,11 +25183,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -24718,8 +25212,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -24789,11 +25283,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -24801,15 +25296,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -24828,7 +25329,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -24910,7 +25412,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -24954,14 +25456,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -25000,7 +25503,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -25095,7 +25598,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -25211,12 +25714,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -25260,9 +25764,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -25289,25 +25793,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -25387,9 +25895,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -25498,11 +26006,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -25526,9 +26034,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -25554,20 +26063,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -25667,14 +26177,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -25689,11 +26202,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -25742,11 +26256,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -25770,8 +26285,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -25841,11 +26356,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -25853,15 +26369,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -25880,7 +26402,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -25962,7 +26485,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -26006,14 +26529,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -26052,7 +26576,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -26147,7 +26671,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -26263,12 +26787,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -26312,9 +26837,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -26341,25 +26866,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -26439,9 +26968,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -26550,11 +27079,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -26578,9 +27107,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -26606,20 +27136,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -26719,14 +27250,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -26741,11 +27275,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -26794,11 +27329,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -26822,8 +27358,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -26893,11 +27429,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -26905,15 +27442,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -26932,7 +27475,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -27014,7 +27558,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -27058,14 +27602,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -27104,7 +27649,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -27199,7 +27744,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -27315,12 +27860,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -27364,9 +27910,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -27393,25 +27939,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -27491,9 +28041,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -27602,11 +28152,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -27630,9 +28180,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -27658,20 +28209,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -27771,14 +28323,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -27793,11 +28348,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -27846,11 +28402,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -27874,8 +28431,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -27945,11 +28502,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -27957,15 +28515,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -27984,7 +28548,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -28066,7 +28631,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -28110,14 +28675,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -28156,7 +28722,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -28251,7 +28817,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -28367,12 +28933,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -28416,9 +28983,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -28445,25 +29012,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -28543,9 +29114,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -28654,11 +29225,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -28682,9 +29253,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -28710,20 +29282,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -28823,14 +29396,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -28845,11 +29421,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -28898,11 +29475,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -28926,8 +29504,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -28997,11 +29575,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -29009,15 +29588,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -29036,7 +29621,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -29118,7 +29704,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -29162,14 +29748,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -29208,7 +29795,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -29303,7 +29890,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -29419,12 +30006,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -29468,9 +30056,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -29497,25 +30085,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -29595,9 +30187,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -29706,11 +30298,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -29734,9 +30326,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -29762,20 +30355,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -29875,14 +30469,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -29897,11 +30494,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -29950,11 +30548,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -29978,8 +30577,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -30049,11 +30648,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -30061,15 +30661,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -30088,7 +30694,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -30170,7 +30777,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -30214,14 +30821,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -30260,7 +30868,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -30355,7 +30963,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -30471,12 +31079,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -30520,9 +31129,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -30549,25 +31158,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -30647,9 +31260,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -30758,11 +31371,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -30786,9 +31399,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -30814,20 +31428,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -30927,14 +31542,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -30949,11 +31567,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -31002,11 +31621,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -31030,8 +31650,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -31101,11 +31721,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -31113,15 +31734,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -31140,7 +31767,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -31222,7 +31850,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -31266,14 +31894,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -31312,7 +31941,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -31407,7 +32036,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -31523,12 +32152,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -31572,9 +32202,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -31601,25 +32231,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -31699,9 +32333,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -31810,11 +32444,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -31838,9 +32472,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -31866,20 +32501,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -31979,14 +32615,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -32001,11 +32640,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -32054,11 +32694,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -32082,8 +32723,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -32153,11 +32794,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -32165,15 +32807,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -32192,7 +32840,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -32274,7 +32923,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -32318,14 +32967,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -32364,7 +33014,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -32459,7 +33109,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -32575,12 +33225,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -32624,9 +33275,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -32653,25 +33304,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -32751,9 +33406,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -32862,11 +33517,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -32890,9 +33545,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -32918,20 +33574,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -33031,14 +33688,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -33053,11 +33713,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -33106,11 +33767,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -33134,8 +33796,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -33205,11 +33867,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -33217,15 +33880,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -33244,7 +33913,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -33326,7 +33996,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -33370,14 +34040,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -33416,7 +34087,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -33511,7 +34182,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -33627,12 +34298,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -33676,9 +34348,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -33705,25 +34377,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -33803,9 +34479,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -33914,11 +34590,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -33942,9 +34618,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -33970,20 +34647,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -34083,14 +34761,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -34105,11 +34786,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -34158,11 +34840,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -34186,8 +34869,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -34257,11 +34940,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -34269,15 +34953,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -34296,7 +34986,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -34378,7 +35069,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -34422,14 +35113,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -34468,7 +35160,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -34563,7 +35255,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -34679,12 +35371,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -34728,9 +35421,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -34757,25 +35450,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -34855,9 +35552,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -34966,11 +35663,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -34994,9 +35691,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -35022,20 +35720,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -35135,14 +35834,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -35157,11 +35859,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -35210,11 +35913,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -35238,8 +35942,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -35309,11 +36013,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -35321,15 +36026,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -35348,7 +36059,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -35430,7 +36142,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -35474,14 +36186,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -35520,7 +36233,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -35615,7 +36328,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -35731,12 +36444,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -35780,9 +36494,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -35809,25 +36523,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -35907,9 +36625,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -36018,11 +36736,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -36046,9 +36764,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -36074,20 +36793,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -36187,14 +36907,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -36209,11 +36932,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -36262,11 +36986,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -36290,8 +37015,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -36361,11 +37086,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -36373,15 +37099,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -36400,7 +37132,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -36482,7 +37215,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -36526,14 +37259,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -36572,7 +37306,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -36667,7 +37401,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -36783,12 +37517,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -36832,9 +37567,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -36861,25 +37596,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -36959,9 +37698,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -37070,11 +37809,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -37098,9 +37837,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -37126,20 +37866,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -37239,14 +37980,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -37261,11 +38005,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -37314,11 +38059,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -37342,8 +38088,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -37413,11 +38159,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -37425,15 +38172,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -37452,7 +38205,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -37534,7 +38288,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -37578,14 +38332,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -37624,7 +38379,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -37719,7 +38474,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -37835,12 +38590,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -37884,9 +38640,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -37913,25 +38669,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -38011,9 +38771,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -38122,11 +38882,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -38150,9 +38910,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -38178,20 +38939,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -38291,14 +39053,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -38313,11 +39078,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -38366,11 +39132,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -38394,8 +39161,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -38465,11 +39232,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -38477,15 +39245,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -38504,7 +39278,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -38586,7 +39361,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -38630,14 +39405,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -38676,7 +39452,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -38771,7 +39547,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -38887,12 +39663,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -38936,9 +39713,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -38965,25 +39742,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -39063,9 +39844,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -39174,11 +39955,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -39202,9 +39983,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -39230,20 +40012,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -39343,14 +40126,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -39365,11 +40151,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -39418,11 +40205,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -39446,8 +40234,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -39517,11 +40305,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -39529,15 +40318,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -39556,7 +40351,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -39638,7 +40434,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -39682,14 +40478,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -39728,7 +40525,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -39823,7 +40620,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -39939,12 +40736,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -39988,9 +40786,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -40017,25 +40815,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -40115,9 +40917,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -40226,11 +41028,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -40254,9 +41056,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -40282,20 +41085,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -40395,14 +41199,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -40417,11 +41224,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -40470,11 +41278,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -40498,8 +41307,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -40569,11 +41378,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -40581,15 +41391,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -40608,7 +41424,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -40690,7 +41507,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -40734,14 +41551,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -40780,7 +41598,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -40875,7 +41693,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -40991,12 +41809,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -41040,9 +41859,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -41069,25 +41888,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -41167,9 +41990,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -41278,11 +42101,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -41306,9 +42129,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -41334,20 +42158,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -41447,14 +42272,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -41469,11 +42297,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -41522,11 +42351,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -41550,8 +42380,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -41621,11 +42451,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -41633,15 +42464,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -41660,7 +42497,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -41742,7 +42580,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -41786,14 +42624,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -41832,7 +42671,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -41927,7 +42766,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -42043,12 +42882,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -42092,9 +42932,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -42121,25 +42961,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -42219,9 +43063,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -42330,11 +43174,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -42358,9 +43202,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -42386,20 +43231,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -42499,14 +43345,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -42521,11 +43370,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -42574,11 +43424,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -42602,8 +43453,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -42673,11 +43524,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -42685,15 +43537,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -42712,7 +43570,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -42794,7 +43653,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -42838,14 +43697,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -42884,7 +43744,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -42979,7 +43839,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -43095,12 +43955,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -43144,9 +44005,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -43173,25 +44034,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -43271,9 +44136,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -43382,11 +44247,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -43410,9 +44275,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -43438,20 +44304,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -43551,14 +44418,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -43573,11 +44443,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -43626,11 +44497,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -43654,8 +44526,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -43725,11 +44597,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -43737,15 +44610,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -43764,7 +44643,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -43846,7 +44726,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -43890,14 +44770,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -43936,7 +44817,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -44031,7 +44912,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -44147,12 +45028,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -44196,9 +45078,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -44225,25 +45107,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -44323,9 +45209,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -44434,11 +45320,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -44462,9 +45348,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -44490,20 +45377,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -44603,14 +45491,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -44625,11 +45516,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -44678,11 +45570,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -44706,8 +45599,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -44777,11 +45670,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -44789,15 +45683,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -44816,7 +45716,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -44898,7 +45799,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -44942,14 +45843,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -44988,7 +45890,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -45083,7 +45985,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -45199,12 +46101,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -45248,9 +46151,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -45277,25 +46180,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -45375,9 +46282,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -45486,11 +46393,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -45514,9 +46421,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -45542,20 +46450,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -45655,14 +46564,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -45677,11 +46589,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -45730,11 +46643,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -45758,8 +46672,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -45829,11 +46743,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -45841,15 +46756,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -45868,7 +46789,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -45950,7 +46872,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -45994,14 +46916,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -46040,7 +46963,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -46135,7 +47058,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -46251,12 +47174,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -46300,9 +47224,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -46329,25 +47253,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -46427,9 +47355,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -46538,11 +47466,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -46566,9 +47494,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -46594,20 +47523,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -46707,14 +47637,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -46729,11 +47662,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -46782,11 +47716,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -46810,8 +47745,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -46881,11 +47816,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -46893,15 +47829,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -46920,7 +47862,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -47002,7 +47945,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -47046,14 +47989,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -47092,7 +48036,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -47187,7 +48131,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -47303,12 +48247,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -47352,9 +48297,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -47381,25 +48326,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -47479,9 +48428,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -47590,11 +48539,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -47618,9 +48567,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -47646,20 +48596,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -47759,14 +48710,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -47781,11 +48735,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -47834,11 +48789,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -47862,8 +48818,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -47933,11 +48889,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -47945,15 +48902,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -47972,7 +48935,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -48054,7 +49018,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -48098,14 +49062,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -48144,7 +49109,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -48239,7 +49204,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -48355,12 +49320,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -48404,9 +49370,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -48433,25 +49399,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -48531,9 +49501,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -48642,11 +49612,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -48670,9 +49640,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -48698,20 +49669,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -48811,14 +49783,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -48833,11 +49808,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -48886,11 +49862,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -48914,8 +49891,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -48985,11 +49962,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -48997,15 +49975,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -49024,7 +50008,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -49106,7 +50091,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -49150,14 +50135,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -49196,7 +50182,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -49291,7 +50277,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -49407,12 +50393,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -49456,9 +50443,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -49485,25 +50472,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -49583,9 +50574,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -49694,11 +50685,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -49722,9 +50713,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -49750,20 +50742,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -49863,14 +50856,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -49885,11 +50881,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -49938,11 +50935,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -49966,8 +50964,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -50037,11 +51035,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -50049,15 +51048,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -50076,7 +51081,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -50158,7 +51164,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -50202,14 +51208,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -50248,7 +51255,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -50343,7 +51350,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -50459,12 +51466,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -50508,9 +51516,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -50537,25 +51545,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -50635,9 +51647,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -50746,11 +51758,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -50774,9 +51786,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -50802,20 +51815,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -50915,14 +51929,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -50937,11 +51954,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -50990,11 +52008,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -51018,8 +52037,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -51089,11 +52108,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -51101,15 +52121,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -51128,7 +52154,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -51210,7 +52237,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -51254,14 +52281,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -51300,7 +52328,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -51395,7 +52423,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -51511,12 +52539,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -51560,9 +52589,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -51589,25 +52618,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -51687,9 +52720,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -51798,11 +52831,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -51826,9 +52859,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -51854,20 +52888,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -51967,14 +53002,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -51989,11 +53027,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -52042,11 +53081,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -52070,8 +53110,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -52141,11 +53181,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -52153,15 +53194,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -52180,7 +53227,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -52262,7 +53310,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -52306,14 +53354,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -52352,7 +53401,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -52447,7 +53496,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -52563,12 +53612,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -52612,9 +53662,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -52641,25 +53691,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -52739,9 +53793,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -52850,11 +53904,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -52878,9 +53932,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -52906,20 +53961,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -53019,14 +54075,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -53041,11 +54100,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -53094,11 +54154,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -53122,8 +54183,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -53193,11 +54254,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -53205,15 +54267,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -53232,7 +54300,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -53314,7 +54383,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -53358,14 +54427,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -53404,7 +54474,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -53499,7 +54569,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -53615,12 +54685,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -53664,9 +54735,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -53693,25 +54764,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -53791,9 +54866,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -53902,11 +54977,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -53930,9 +55005,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -53958,20 +55034,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -54071,14 +55148,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -54093,11 +55173,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -54146,11 +55227,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -54174,8 +55256,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -54245,11 +55327,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -54257,15 +55340,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -54284,7 +55373,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -54366,7 +55456,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -54410,14 +55500,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -54456,7 +55547,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -54551,7 +55642,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -54667,12 +55758,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -54716,9 +55808,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -54745,25 +55837,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -54843,9 +55939,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -54954,11 +56050,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -54982,9 +56078,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -55010,20 +56107,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -55123,14 +56221,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -55145,11 +56246,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -55198,11 +56300,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -55226,8 +56329,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -55297,11 +56400,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -55309,15 +56413,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -55336,7 +56446,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -55418,7 +56529,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -55462,14 +56573,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -55508,7 +56620,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -55603,7 +56715,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -55719,12 +56831,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -55768,9 +56881,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -55797,25 +56910,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -55895,9 +57012,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -56006,11 +57123,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -56034,9 +57151,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -56062,20 +57180,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -56175,14 +57294,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -56197,11 +57319,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -56250,11 +57373,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -56278,8 +57402,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -56349,11 +57473,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -56361,15 +57486,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -56388,7 +57519,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -56470,7 +57602,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -56514,14 +57646,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -56560,7 +57693,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -56655,7 +57788,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -56771,12 +57904,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -56820,9 +57954,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -56849,25 +57983,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -56947,9 +58085,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -57058,11 +58196,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -57086,9 +58224,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -57114,20 +58253,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -57227,14 +58367,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -57249,11 +58392,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -57302,11 +58446,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -57330,8 +58475,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -57401,11 +58546,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -57413,15 +58559,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -57440,7 +58592,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -57522,7 +58675,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -57566,14 +58719,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -57612,7 +58766,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -57707,7 +58861,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -57823,12 +58977,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -57872,9 +59027,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -57901,25 +59056,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -57999,9 +59158,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -58110,11 +59269,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -58138,9 +59297,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -58166,20 +59326,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -58279,14 +59440,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -58301,11 +59465,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -58354,11 +59519,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -58382,8 +59548,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -58453,11 +59619,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -58465,15 +59632,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -58492,7 +59665,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -58574,7 +59748,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -58618,14 +59792,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -58664,7 +59839,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -58759,7 +59934,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -58875,12 +60050,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -58924,9 +60100,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -58953,25 +60129,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -59051,9 +60231,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -59162,11 +60342,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -59190,9 +60370,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -59218,20 +60399,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -59331,14 +60513,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -59353,11 +60538,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -59406,11 +60592,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -59434,8 +60621,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -59505,11 +60692,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -59517,15 +60705,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -59544,7 +60738,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -59626,7 +60821,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -59670,14 +60865,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -59716,7 +60912,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -59811,7 +61007,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -59927,12 +61123,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -59976,9 +61173,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -60005,25 +61202,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -60103,9 +61304,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -60214,11 +61415,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -60242,9 +61443,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -60270,20 +61472,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -60383,14 +61586,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -60405,11 +61611,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -60458,11 +61665,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -60486,8 +61694,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -60557,11 +61765,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -60569,15 +61778,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -60596,7 +61811,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -60678,7 +61894,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -60722,14 +61938,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -60768,7 +61985,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -60863,7 +62080,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -60979,12 +62196,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -61028,9 +62246,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -61057,25 +62275,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -61155,9 +62377,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -61266,11 +62488,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -61294,9 +62516,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -61322,20 +62545,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -61435,14 +62659,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -61457,11 +62684,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -61510,11 +62738,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -61538,8 +62767,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -61609,11 +62838,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -61621,15 +62851,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -61648,7 +62884,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -61730,7 +62967,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -61774,14 +63011,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -61820,7 +63058,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -61915,7 +63153,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -62031,12 +63269,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -62080,9 +63319,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -62109,25 +63348,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -62207,9 +63450,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -62318,11 +63561,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -62346,9 +63589,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -62374,20 +63618,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -62487,14 +63732,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -62509,11 +63757,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -62562,11 +63811,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -62590,8 +63840,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -62661,11 +63911,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -62673,15 +63924,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -62700,7 +63957,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -62782,7 +64040,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -62826,14 +64084,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -62872,7 +64131,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -62967,7 +64226,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -63083,12 +64342,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -63132,9 +64392,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -63161,25 +64421,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -63259,9 +64523,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -63370,11 +64634,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -63398,9 +64662,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -63426,20 +64691,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -63539,14 +64805,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -63561,11 +64830,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -63614,11 +64884,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -63642,8 +64913,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -63713,11 +64984,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -63725,15 +64997,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -63752,7 +65030,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -63834,7 +65113,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -63878,14 +65157,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -63924,7 +65204,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -64019,7 +65299,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -64135,12 +65415,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -64184,9 +65465,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -64213,25 +65494,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -64311,9 +65596,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -64422,11 +65707,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -64450,9 +65735,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -64478,20 +65764,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -64591,14 +65878,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -64613,11 +65903,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -64666,11 +65957,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -64694,8 +65986,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -64765,11 +66057,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -64777,15 +66070,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -64804,7 +66103,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -64886,7 +66186,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -64930,14 +66230,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -64976,7 +66277,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -65071,7 +66372,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -65187,12 +66488,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -65236,9 +66538,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -65265,25 +66567,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -65363,9 +66669,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -65474,11 +66780,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -65502,9 +66808,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -65530,20 +66837,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -65643,14 +66951,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -65665,11 +66976,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -65718,11 +67030,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -65746,8 +67059,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -65817,11 +67130,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -65829,15 +67143,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -65856,7 +67176,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -65938,7 +67259,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -65982,14 +67303,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -66028,7 +67350,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -66123,7 +67445,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -66239,12 +67561,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -66288,9 +67611,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -66317,25 +67640,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -66415,9 +67742,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -66526,11 +67853,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -66554,9 +67881,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -66582,20 +67910,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -66695,14 +68024,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -66717,11 +68049,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -66770,11 +68103,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -66798,8 +68132,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -66869,11 +68203,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -66881,15 +68216,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -66908,7 +68249,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -66990,7 +68332,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -67034,14 +68376,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -67080,7 +68423,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -67175,7 +68518,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -67291,12 +68634,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -67340,9 +68684,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -67369,25 +68713,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -67467,9 +68815,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -67578,11 +68926,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -67606,9 +68954,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -67634,20 +68983,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -67747,14 +69097,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -67769,11 +69122,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -67822,11 +69176,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -67850,8 +69205,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -67921,11 +69276,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -67933,15 +69289,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -67960,7 +69322,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -68042,7 +69405,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -68086,14 +69449,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -68132,7 +69496,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -68227,7 +69591,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -68343,12 +69707,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -68392,9 +69757,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -68421,25 +69786,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -68519,9 +69888,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -68630,11 +69999,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -68658,9 +70027,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -68686,20 +70056,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -68799,14 +70170,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -68821,11 +70195,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -68874,11 +70249,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -68902,8 +70278,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -68973,11 +70349,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -68985,15 +70362,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -69012,7 +70395,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -69094,7 +70478,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -69138,14 +70522,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -69184,7 +70569,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -69279,7 +70664,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -69395,12 +70780,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -69444,9 +70830,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -69473,25 +70859,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -69571,9 +70961,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -69682,11 +71072,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -69710,9 +71100,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -69738,20 +71129,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -69851,14 +71243,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -69873,11 +71268,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -69926,11 +71322,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -69954,8 +71351,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -70025,11 +71422,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -70037,15 +71435,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -70064,7 +71468,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -70146,7 +71551,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -70190,14 +71595,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -70236,7 +71642,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -70331,7 +71737,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -70447,12 +71853,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -70496,9 +71903,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -70525,25 +71932,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -70623,9 +72034,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -70734,11 +72145,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -70762,9 +72173,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -70790,20 +72202,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -70903,14 +72316,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -70925,11 +72341,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -70978,11 +72395,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -71006,8 +72424,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -71077,11 +72495,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -71089,15 +72508,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -71116,7 +72541,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -71198,7 +72624,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -71242,14 +72668,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -71288,7 +72715,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -71383,7 +72810,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -71499,12 +72926,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -71548,9 +72976,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -71577,25 +73005,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -71675,9 +73107,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -71786,11 +73218,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -71814,9 +73246,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -71842,20 +73275,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -71955,14 +73389,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -71977,11 +73414,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -72030,11 +73468,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -72058,8 +73497,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -72129,11 +73568,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -72141,15 +73581,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -72168,7 +73614,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -72250,7 +73697,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -72294,14 +73741,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -72340,7 +73788,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -72435,7 +73883,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -72551,12 +73999,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -72600,9 +74049,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -72629,25 +74078,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -72727,9 +74180,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -72838,11 +74291,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -72866,9 +74319,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -72894,20 +74348,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -73007,14 +74462,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -73029,11 +74487,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -73082,11 +74541,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -73110,8 +74570,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -73181,11 +74641,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -73193,15 +74654,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -73220,7 +74687,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -73302,7 +74770,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -73346,14 +74814,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -73392,7 +74861,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -73487,7 +74956,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -73603,12 +75072,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -73652,9 +75122,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -73681,25 +75151,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -73779,9 +75253,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -73890,11 +75364,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -73918,9 +75392,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -73946,20 +75421,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -74059,14 +75535,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -74081,11 +75560,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -74134,11 +75614,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -74162,8 +75643,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -74233,11 +75714,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -74245,15 +75727,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -74272,7 +75760,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -74354,7 +75843,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -74398,14 +75887,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -74444,7 +75934,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -74539,7 +76029,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -74655,12 +76145,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -74704,9 +76195,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -74733,25 +76224,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -74831,9 +76326,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -74942,11 +76437,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -74970,9 +76465,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -74998,20 +76494,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -75111,14 +76608,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -75133,11 +76633,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -75186,11 +76687,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -75214,8 +76716,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -75285,11 +76787,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -75297,15 +76800,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -75324,7 +76833,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -75406,7 +76916,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -75450,14 +76960,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -75496,7 +77007,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -75591,7 +77102,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -75707,12 +77218,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -75756,9 +77268,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -75785,25 +77297,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -75883,9 +77399,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -75994,11 +77510,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -76022,9 +77538,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -76050,20 +77567,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -76163,14 +77681,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -76185,11 +77706,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -76238,11 +77760,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -76266,8 +77789,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -76337,11 +77860,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -76349,15 +77873,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -76376,7 +77906,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -76458,7 +77989,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -76502,14 +78033,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -76548,7 +78080,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -76643,7 +78175,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -76759,12 +78291,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -76808,9 +78341,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -76837,25 +78370,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -76935,9 +78472,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -77046,11 +78583,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -77074,9 +78611,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -77102,20 +78640,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -77215,14 +78754,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -77237,11 +78779,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -77290,11 +78833,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -77318,8 +78862,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -77389,11 +78933,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -77401,15 +78946,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -77428,7 +78979,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -77510,7 +79062,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -77554,14 +79106,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -77600,7 +79153,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -77695,7 +79248,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -77811,12 +79364,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -77860,9 +79414,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -77889,25 +79443,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -77987,9 +79545,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -78098,11 +79656,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -78126,9 +79684,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -78154,20 +79713,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -78267,14 +79827,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -78289,11 +79852,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -78342,11 +79906,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -78370,8 +79935,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -78441,11 +80006,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -78453,15 +80019,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -78480,7 +80052,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -78562,7 +80135,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -78606,14 +80179,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -78652,7 +80226,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -78747,7 +80321,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -78863,12 +80437,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -78912,9 +80487,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -78941,25 +80516,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -79039,9 +80618,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -79150,11 +80729,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -79178,9 +80757,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -79206,20 +80786,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -79319,14 +80900,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -79341,11 +80925,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -79394,11 +80979,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -79422,8 +81008,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -79493,11 +81079,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -79505,15 +81092,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -79532,7 +81125,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -79614,7 +81208,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -79658,14 +81252,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -79704,7 +81299,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -79799,7 +81394,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -79915,12 +81510,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -79964,9 +81560,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -79993,25 +81589,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -80091,9 +81691,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -80202,11 +81802,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -80230,9 +81830,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -80258,20 +81859,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -80371,14 +81973,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -80393,11 +81998,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -80446,11 +82052,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -80474,8 +82081,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -80545,11 +82152,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -80557,15 +82165,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -80584,7 +82198,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -80666,7 +82281,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -80710,14 +82325,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -80756,7 +82372,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -80851,7 +82467,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -80967,12 +82583,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -81016,9 +82633,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -81045,25 +82662,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -81143,9 +82764,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -81254,11 +82875,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -81282,9 +82903,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -81310,20 +82932,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -81423,14 +83046,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -81445,11 +83071,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -81498,11 +83125,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -81526,8 +83154,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -81597,11 +83225,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -81609,15 +83238,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -81636,7 +83271,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -81718,7 +83354,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -81762,14 +83398,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -81808,7 +83445,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -81903,7 +83540,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -82019,12 +83656,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -82068,9 +83706,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -82097,25 +83735,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -82195,9 +83837,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -82306,11 +83948,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -82334,9 +83976,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -82362,20 +84005,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -82475,14 +84119,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -82497,11 +84144,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -82550,11 +84198,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -82578,8 +84227,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -82649,11 +84298,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -82661,15 +84311,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -82688,7 +84344,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -82770,7 +84427,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -82814,14 +84471,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -82860,7 +84518,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -82955,7 +84613,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -83071,12 +84729,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -83120,9 +84779,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -83149,25 +84808,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -83247,9 +84910,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -83358,11 +85021,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -83386,9 +85049,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -83414,20 +85078,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -83527,14 +85192,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -83549,11 +85217,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -83602,11 +85271,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -83630,8 +85300,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -83701,11 +85371,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -83713,15 +85384,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -83740,7 +85417,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -83822,7 +85500,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -83866,14 +85544,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -83912,7 +85591,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -84007,7 +85686,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -84123,12 +85802,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -84172,9 +85852,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -84201,25 +85881,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -84299,9 +85983,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -84410,11 +86094,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -84438,9 +86122,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -84466,20 +86151,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -84579,14 +86265,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -84601,11 +86290,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -84654,11 +86344,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -84682,8 +86373,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -84753,11 +86444,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -84765,15 +86457,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -84792,7 +86490,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -84874,7 +86573,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -84918,14 +86617,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -84964,7 +86664,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -85059,7 +86759,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -85175,12 +86875,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -85224,9 +86925,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -85253,25 +86954,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -85351,9 +87056,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -85462,11 +87167,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -85490,9 +87195,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -85518,20 +87224,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -85631,14 +87338,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -85653,11 +87363,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -85706,11 +87417,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -85734,8 +87446,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -85805,11 +87517,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -85817,15 +87530,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -85844,7 +87563,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -85926,7 +87646,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -85970,14 +87690,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -86016,7 +87737,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -86111,7 +87832,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -86227,12 +87948,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -86276,9 +87998,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -86305,25 +88027,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -86403,9 +88129,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -86514,11 +88240,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -86542,9 +88268,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -86570,20 +88297,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -86683,14 +88411,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -86705,11 +88436,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -86758,11 +88490,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -86786,8 +88519,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -86857,11 +88590,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -86869,15 +88603,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -86896,7 +88636,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -86978,7 +88719,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -87022,14 +88763,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -87068,7 +88810,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -87163,7 +88905,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -87279,12 +89021,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -87328,9 +89071,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -87357,25 +89100,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -87455,9 +89202,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -87566,11 +89313,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -87594,9 +89341,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -87622,20 +89370,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -87735,14 +89484,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -87757,11 +89509,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -87810,11 +89563,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -87838,8 +89592,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -87909,11 +89663,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -87921,15 +89676,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -87948,7 +89709,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -88030,7 +89792,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -88074,14 +89836,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -88120,7 +89883,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -88215,7 +89978,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -88331,12 +90094,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -88380,9 +90144,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -88409,25 +90173,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -88507,9 +90275,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -88618,11 +90386,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -88646,9 +90414,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -88674,20 +90443,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -88787,14 +90557,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -88809,11 +90582,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -88862,11 +90636,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -88890,8 +90665,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -88961,11 +90736,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -88973,15 +90749,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -89000,7 +90782,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -89082,7 +90865,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -89126,14 +90909,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -89172,7 +90956,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -89267,7 +91051,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -89383,12 +91167,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -89432,9 +91217,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -89461,25 +91246,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -89559,9 +91348,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -89670,11 +91459,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -89698,9 +91487,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -89726,20 +91516,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -89839,14 +91630,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -89861,11 +91655,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -89914,11 +91709,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -89942,8 +91738,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -90013,11 +91809,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -90025,15 +91822,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -90052,7 +91855,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -90134,7 +91938,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -90178,14 +91982,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -90224,7 +92029,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -90319,7 +92124,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -90435,12 +92240,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -90484,9 +92290,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -90513,25 +92319,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -90611,9 +92421,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -90722,11 +92532,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -90750,9 +92560,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -90778,20 +92589,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -90891,14 +92703,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -90913,11 +92728,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -90966,11 +92782,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -90994,8 +92811,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -91065,11 +92882,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -91077,15 +92895,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -91104,7 +92928,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -91186,7 +93011,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -91230,14 +93055,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -91276,7 +93102,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -91371,7 +93197,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -91487,12 +93313,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -91536,9 +93363,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -91565,25 +93392,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -91663,9 +93494,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -91774,11 +93605,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -91802,9 +93633,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -91830,20 +93662,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -91943,14 +93776,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -91965,11 +93801,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -92018,11 +93855,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -92046,8 +93884,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -92117,11 +93955,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -92129,15 +93968,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -92156,7 +94001,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -92238,7 +94084,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -92282,14 +94128,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -92328,7 +94175,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -92423,7 +94270,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -92539,12 +94386,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -92588,9 +94436,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -92617,25 +94465,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -92715,9 +94567,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -92826,11 +94678,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -92854,9 +94706,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -92882,20 +94735,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -92995,14 +94849,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -93017,11 +94874,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -93070,11 +94928,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -93098,8 +94957,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -93169,11 +95028,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -93181,15 +95041,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -93208,7 +95074,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -93290,7 +95157,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -93334,14 +95201,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -93380,7 +95248,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -93475,7 +95343,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -93591,12 +95459,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -93640,9 +95509,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -93669,25 +95538,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -93767,9 +95640,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -93878,11 +95751,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -93906,9 +95779,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -93934,20 +95808,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -94047,14 +95922,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -94069,11 +95947,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -94122,11 +96001,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -94150,8 +96030,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -94221,11 +96101,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -94233,15 +96114,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -94260,7 +96147,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -94342,7 +96230,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -94386,14 +96274,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -94432,7 +96321,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -94527,7 +96416,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -94643,12 +96532,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -94692,9 +96582,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -94721,25 +96611,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -94819,9 +96713,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -94930,11 +96824,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -94958,9 +96852,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -94986,20 +96881,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -95099,14 +96995,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -95121,11 +97020,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -95174,11 +97074,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -95202,8 +97103,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -95273,11 +97174,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -95285,15 +97187,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -95312,7 +97220,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -95394,7 +97303,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -95438,14 +97347,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -95484,7 +97394,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -95579,7 +97489,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -95695,12 +97605,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -95744,9 +97655,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -95773,25 +97684,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -95871,9 +97786,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -95982,11 +97897,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -96010,9 +97925,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -96038,20 +97954,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -96151,14 +98068,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -96173,11 +98093,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -96226,11 +98147,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -96254,8 +98176,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -96325,11 +98247,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -96337,15 +98260,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -96364,7 +98293,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -96446,7 +98376,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -96490,14 +98420,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -96536,7 +98467,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -96631,7 +98562,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -96747,12 +98678,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -96796,9 +98728,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -96825,25 +98757,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -96923,9 +98859,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -97034,11 +98970,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -97062,9 +98998,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -97090,20 +99027,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -97203,14 +99141,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -97225,11 +99166,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -97278,11 +99220,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -97306,8 +99249,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -97377,11 +99320,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -97389,15 +99333,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -97416,7 +99366,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -97498,7 +99449,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -97542,14 +99493,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -97588,7 +99540,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -97683,7 +99635,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -97799,12 +99751,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -97848,9 +99801,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -97877,25 +99830,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -97975,9 +99932,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -98086,11 +100043,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -98114,9 +100071,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -98142,20 +100100,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -98255,14 +100214,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -98277,11 +100239,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -98330,11 +100293,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -98358,8 +100322,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -98429,11 +100393,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -98441,15 +100406,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -98468,7 +100439,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -98550,7 +100522,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -98594,14 +100566,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -98640,7 +100613,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -98735,7 +100708,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -98851,12 +100824,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -98900,9 +100874,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -98929,25 +100903,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -99027,9 +101005,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -99138,11 +101116,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -99166,9 +101144,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -99194,20 +101173,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -99307,14 +101287,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -99329,11 +101312,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -99382,11 +101366,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -99410,8 +101395,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -99481,11 +101466,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -99493,15 +101479,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -99520,7 +101512,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -99602,7 +101595,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -99646,14 +101639,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -99692,7 +101686,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -99787,7 +101781,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -99903,12 +101897,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -99952,9 +101947,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -99981,25 +101976,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -100079,9 +102078,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -100190,11 +102189,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -100218,9 +102217,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -100246,20 +102246,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -100359,14 +102360,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -100381,11 +102385,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -100434,11 +102439,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -100462,8 +102468,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -100533,11 +102539,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -100545,15 +102552,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -100572,7 +102585,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -100654,7 +102668,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -100698,14 +102712,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -100744,7 +102759,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -100839,7 +102854,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -100955,12 +102970,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -101004,9 +103020,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -101033,25 +103049,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -101131,9 +103151,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -101242,11 +103262,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -101270,9 +103290,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -101298,20 +103319,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -101411,14 +103433,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -101433,11 +103458,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -101486,11 +103512,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -101514,8 +103541,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -101585,11 +103612,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -101597,15 +103625,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -101624,7 +103658,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -101706,7 +103741,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -101750,14 +103785,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -101796,7 +103832,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -101891,7 +103927,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -102007,12 +104043,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -102056,9 +104093,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -102085,25 +104122,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -102183,9 +104224,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -102294,11 +104335,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -102322,9 +104363,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -102350,20 +104392,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -102463,14 +104506,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -102485,11 +104531,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -102538,11 +104585,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -102566,8 +104614,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -102637,11 +104685,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -102649,15 +104698,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -102676,7 +104731,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -102758,7 +104814,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -102802,14 +104858,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -102848,7 +104905,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -102943,7 +105000,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -103059,12 +105116,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -103108,9 +105166,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -103137,25 +105195,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -103235,9 +105297,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -103346,11 +105408,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -103374,9 +105436,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -103402,20 +105465,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -103515,14 +105579,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -103537,11 +105604,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -103590,11 +105658,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -103618,8 +105687,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -103689,11 +105758,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -103701,15 +105771,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -103728,7 +105804,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -103810,7 +105887,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -103854,14 +105931,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -103900,7 +105978,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -103995,7 +106073,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -104111,12 +106189,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -104160,9 +106239,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -104189,25 +106268,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -104287,9 +106370,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -104398,11 +106481,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -104426,9 +106509,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -104454,20 +106538,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -104567,14 +106652,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -104589,11 +106677,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -104642,11 +106731,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -104670,8 +106760,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -104741,11 +106831,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -104753,15 +106844,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -104780,7 +106877,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -104862,7 +106960,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -104906,14 +107004,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -104952,7 +107051,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -105047,7 +107146,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -105163,12 +107262,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -105212,9 +107312,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -105241,25 +107341,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -105339,9 +107443,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -105450,11 +107554,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -105478,9 +107582,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -105506,20 +107611,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -105619,14 +107725,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -105641,11 +107750,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -105694,11 +107804,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -105722,8 +107833,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -105793,11 +107904,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -105805,15 +107917,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -105832,7 +107950,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -105914,7 +108033,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -105958,14 +108077,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -106004,7 +108124,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -106099,7 +108219,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -106215,12 +108335,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -106264,9 +108385,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -106293,25 +108414,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -106391,9 +108516,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -106502,11 +108627,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -106530,9 +108655,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -106558,20 +108684,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -106671,14 +108798,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -106693,11 +108823,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -106746,11 +108877,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -106774,8 +108906,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -106845,11 +108977,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -106857,15 +108990,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -106884,7 +109023,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -106966,7 +109106,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -107010,14 +109150,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -107056,7 +109197,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -107151,7 +109292,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -107267,12 +109408,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -107316,9 +109458,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -107345,25 +109487,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -107443,9 +109589,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -107554,11 +109700,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -107582,9 +109728,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -107610,20 +109757,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -107723,14 +109871,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -107745,11 +109896,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -107798,11 +109950,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -107826,8 +109979,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -107897,11 +110050,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -107909,15 +110063,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -107936,7 +110096,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -108018,7 +110179,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -108062,14 +110223,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -108108,7 +110270,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -108203,7 +110365,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -108319,12 +110481,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -108368,9 +110531,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -108397,25 +110560,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -108495,9 +110662,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -108606,11 +110773,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -108634,9 +110801,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -108662,20 +110830,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -108775,14 +110944,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -108797,11 +110969,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -108850,11 +111023,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -108878,8 +111052,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -108949,11 +111123,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -108961,15 +111136,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -108988,7 +111169,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -109070,7 +111252,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -109114,14 +111296,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -109160,7 +111343,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -109255,7 +111438,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -109371,12 +111554,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -109420,9 +111604,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -109449,25 +111633,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -109547,9 +111735,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -109658,11 +111846,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -109686,9 +111874,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -109714,20 +111903,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -109827,14 +112017,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -109849,11 +112042,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -109902,11 +112096,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -109930,8 +112125,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -110001,11 +112196,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -110013,15 +112209,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -110040,7 +112242,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -110122,7 +112325,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -110166,14 +112369,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -110212,7 +112416,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -110307,7 +112511,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -110423,12 +112627,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -110472,9 +112677,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -110501,25 +112706,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -110599,9 +112808,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -110710,11 +112919,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -110738,9 +112947,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -110766,20 +112976,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -110879,14 +113090,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -110901,11 +113115,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -110954,11 +113169,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -110982,8 +113198,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -111053,11 +113269,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -111065,15 +113282,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -111092,7 +113315,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -111174,7 +113398,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -111218,14 +113442,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -111264,7 +113489,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -111359,7 +113584,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -111475,12 +113700,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -111524,9 +113750,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -111553,25 +113779,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -111651,9 +113881,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -111762,11 +113992,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -111790,9 +114020,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -111818,20 +114049,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -111931,14 +114163,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -111953,11 +114188,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -112006,11 +114242,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -112034,8 +114271,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -112105,11 +114342,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -112117,15 +114355,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -112144,7 +114388,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -112226,7 +114471,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -112270,14 +114515,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -112316,7 +114562,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -112411,7 +114657,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -112527,12 +114773,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -112576,9 +114823,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -112605,25 +114852,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -112703,9 +114954,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -112814,11 +115065,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -112842,9 +115093,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -112870,20 +115122,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -112983,14 +115236,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -113005,11 +115261,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -113058,11 +115315,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -113086,8 +115344,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -113157,11 +115415,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -113169,15 +115428,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -113196,7 +115461,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -113278,7 +115544,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -113322,14 +115588,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -113368,7 +115635,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -113463,7 +115730,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -113579,12 +115846,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -113628,9 +115896,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -113657,25 +115925,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -113755,9 +116027,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -113866,11 +116138,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -113894,9 +116166,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -113922,20 +116195,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -114035,14 +116309,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -114057,11 +116334,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -114110,11 +116388,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -114138,8 +116417,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -114209,11 +116488,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -114221,15 +116501,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -114248,7 +116534,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -114330,7 +116617,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -114374,14 +116661,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -114420,7 +116708,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -114515,7 +116803,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -114631,12 +116919,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -114680,9 +116969,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -114709,25 +116998,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -114807,9 +117100,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -114918,11 +117211,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -114946,9 +117239,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -114974,20 +117268,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -115087,14 +117382,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -115109,11 +117407,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -115162,11 +117461,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -115190,8 +117490,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -115261,11 +117561,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -115273,15 +117574,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -115300,7 +117607,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -115382,7 +117690,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -115426,14 +117734,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -115472,7 +117781,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -115567,7 +117876,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -115683,12 +117992,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -115732,9 +118042,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -115761,25 +118071,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -115859,9 +118173,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -115970,11 +118284,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -115998,9 +118312,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -116026,20 +118341,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -116139,14 +118455,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -116161,11 +118480,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -116214,11 +118534,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -116242,8 +118563,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -116313,11 +118634,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -116325,15 +118647,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -116352,7 +118680,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -116434,7 +118763,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -116478,14 +118807,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -116524,7 +118854,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -116619,7 +118949,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -116735,12 +119065,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -116784,9 +119115,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -116813,25 +119144,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -116911,9 +119246,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -117022,11 +119357,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -117050,9 +119385,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -117078,20 +119414,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -117191,14 +119528,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -117213,11 +119553,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -117266,11 +119607,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -117294,8 +119636,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -117365,11 +119707,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -117377,15 +119720,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -117404,7 +119753,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -117486,7 +119836,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -117530,14 +119880,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -117576,7 +119927,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -117671,7 +120022,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -117787,12 +120138,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -117836,9 +120188,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -117865,25 +120217,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -117963,9 +120319,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -118074,11 +120430,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -118102,9 +120458,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -118130,20 +120487,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -118243,14 +120601,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -118265,11 +120626,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -118318,11 +120680,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -118346,8 +120709,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -118417,11 +120780,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -118429,15 +120793,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -118456,7 +120826,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -118538,7 +120909,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -118582,14 +120953,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -118628,7 +121000,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -118723,7 +121095,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -118839,12 +121211,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -118888,9 +121261,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -118917,25 +121290,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -119015,9 +121392,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -119126,11 +121503,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -119154,9 +121531,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -119182,20 +121560,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -119295,14 +121674,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -119317,11 +121699,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -119370,11 +121753,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -119398,8 +121782,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -119469,11 +121853,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -119481,15 +121866,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -119508,7 +121899,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -119590,7 +121982,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -119634,14 +122026,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -119680,7 +122073,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -119775,7 +122168,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -119891,12 +122284,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -119940,9 +122334,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -119969,25 +122363,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -120067,9 +122465,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -120178,11 +122576,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -120206,9 +122604,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -120234,20 +122633,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -120347,14 +122747,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -120369,11 +122772,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -120422,11 +122826,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -120450,8 +122855,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -120521,11 +122926,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -120533,15 +122939,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -120560,7 +122972,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -120642,7 +123055,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -120686,14 +123099,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -120732,7 +123146,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -120827,7 +123241,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -120943,12 +123357,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -120992,9 +123407,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -121021,25 +123436,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -121119,9 +123538,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -121230,11 +123649,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -121258,9 +123677,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -121286,20 +123706,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -121399,14 +123820,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -121421,11 +123845,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -121474,11 +123899,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -121502,8 +123928,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -121573,11 +123999,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -121585,15 +124012,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -121612,7 +124045,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -121694,7 +124128,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -121738,14 +124172,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -121784,7 +124219,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -121879,7 +124314,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -121995,12 +124430,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -122044,9 +124480,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -122073,25 +124509,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -122171,9 +124611,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -122282,11 +124722,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -122310,9 +124750,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -122338,20 +124779,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -122451,14 +124893,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -122473,11 +124918,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -122526,11 +124972,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -122554,8 +125001,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -122625,11 +125072,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -122637,15 +125085,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -122664,7 +125118,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -122746,7 +125201,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -122790,14 +125245,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -122836,7 +125292,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -122931,7 +125387,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -123047,12 +125503,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -123096,9 +125553,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -123125,25 +125582,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -123223,9 +125684,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -123334,11 +125795,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -123362,9 +125823,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -123390,20 +125852,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -123503,14 +125966,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -123525,11 +125991,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -123578,11 +126045,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -123606,8 +126074,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -123677,11 +126145,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -123689,15 +126158,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -123716,7 +126191,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -123798,7 +126274,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -123842,14 +126318,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -123888,7 +126365,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -123983,7 +126460,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -124099,12 +126576,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -124148,9 +126626,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -124177,25 +126655,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -124275,9 +126757,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -124386,11 +126868,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -124414,9 +126896,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -124442,20 +126925,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -124555,14 +127039,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -124577,11 +127064,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -124630,11 +127118,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -124658,8 +127147,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -124729,11 +127218,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -124741,15 +127231,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -124768,7 +127264,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -124850,7 +127347,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -124894,14 +127391,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -124940,7 +127438,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -125035,7 +127533,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -125151,12 +127649,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -125200,9 +127699,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -125229,25 +127728,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -125327,9 +127830,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -125438,11 +127941,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -125466,9 +127969,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -125494,20 +127998,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -125607,14 +128112,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -125629,11 +128137,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -125682,11 +128191,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -125710,8 +128220,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -125781,11 +128291,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -125793,15 +128304,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -125820,7 +128337,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -125902,7 +128420,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -125946,14 +128464,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -125992,7 +128511,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -126087,7 +128606,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -126203,12 +128722,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -126252,9 +128772,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -126281,25 +128801,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -126379,9 +128903,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -126490,11 +129014,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -126518,9 +129042,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -126546,20 +129071,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -126659,14 +129185,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -126681,11 +129210,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -126734,11 +129264,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -126762,8 +129293,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -126833,11 +129364,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -126845,15 +129377,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -126872,7 +129410,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -126954,7 +129493,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -126998,14 +129537,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -127044,7 +129584,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -127139,7 +129679,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -127255,12 +129795,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -127304,9 +129845,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -127333,25 +129874,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -127431,9 +129976,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -127542,11 +130087,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -127570,9 +130115,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -127598,20 +130144,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -127711,14 +130258,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -127733,11 +130283,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -127786,11 +130337,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -127814,8 +130366,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -127885,11 +130437,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -127897,15 +130450,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -127924,7 +130483,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -128006,7 +130566,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -128050,14 +130610,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -128096,7 +130657,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -128191,7 +130752,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -128307,12 +130868,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -128356,9 +130918,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -128385,25 +130947,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -128483,9 +131049,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -128594,11 +131160,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -128622,9 +131188,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -128650,20 +131217,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -128763,14 +131331,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -128785,11 +131356,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -128838,11 +131410,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -128866,8 +131439,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -128937,11 +131510,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -128949,15 +131523,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -128976,7 +131556,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -129058,7 +131639,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -129102,14 +131683,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -129148,7 +131730,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -129243,7 +131825,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -129359,12 +131941,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -129408,9 +131991,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -129437,25 +132020,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -129535,9 +132122,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -129646,11 +132233,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -129674,9 +132261,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -129702,20 +132290,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -129815,14 +132404,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -129837,11 +132429,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -129890,11 +132483,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -129918,8 +132512,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -129989,11 +132583,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -130001,15 +132596,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -130028,7 +132629,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -130110,7 +132712,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -130154,14 +132756,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -130200,7 +132803,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -130295,7 +132898,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -130411,12 +133014,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -130460,9 +133064,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -130489,25 +133093,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -130587,9 +133195,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -130698,11 +133306,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -130726,9 +133334,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -130754,20 +133363,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -130867,14 +133477,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -130889,11 +133502,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -130942,11 +133556,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -130970,8 +133585,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -131041,11 +133656,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -131053,15 +133669,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -131080,7 +133702,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -131162,7 +133785,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -131206,14 +133829,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -131252,7 +133876,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -131347,7 +133971,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -131463,12 +134087,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -131512,9 +134137,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -131541,25 +134166,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -131639,9 +134268,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -131750,11 +134379,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -131778,9 +134407,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -131806,20 +134436,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -131919,14 +134550,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -131941,11 +134575,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -131994,11 +134629,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -132022,8 +134658,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -132093,11 +134729,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -132105,15 +134742,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -132132,7 +134775,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -132214,7 +134858,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -132258,14 +134902,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -132304,7 +134949,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -132399,7 +135044,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -132515,12 +135160,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -132564,9 +135210,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -132593,25 +135239,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -132691,9 +135341,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -132802,11 +135452,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -132830,9 +135480,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -132858,20 +135509,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -132971,14 +135623,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -132993,11 +135648,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -133046,11 +135702,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -133074,8 +135731,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -133145,11 +135802,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -133157,15 +135815,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -133184,7 +135848,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -133266,7 +135931,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -133310,14 +135975,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -133356,7 +136022,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -133451,7 +136117,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -133567,12 +136233,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -133616,9 +136283,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -133645,25 +136312,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -133743,9 +136414,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -133854,11 +136525,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -133882,9 +136553,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -133910,20 +136582,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -134023,14 +136696,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -134045,11 +136721,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -134098,11 +136775,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -134126,8 +136804,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -134197,11 +136875,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -134209,15 +136888,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -134236,7 +136921,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -134318,7 +137004,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -134362,14 +137048,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -134408,7 +137095,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -134503,7 +137190,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -134619,12 +137306,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -134668,9 +137356,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -134697,25 +137385,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -134795,9 +137487,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -134906,11 +137598,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -134934,9 +137626,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -134962,20 +137655,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -135075,14 +137769,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -135097,11 +137794,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -135150,11 +137848,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -135178,8 +137877,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -135249,11 +137948,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -135261,15 +137961,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -135288,7 +137994,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -135370,7 +138077,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -135414,14 +138121,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -135460,7 +138168,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -135555,7 +138263,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -135671,12 +138379,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -135720,9 +138429,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -135749,25 +138458,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -135847,9 +138560,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -135958,11 +138671,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -135986,9 +138699,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -136014,20 +138728,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -136127,14 +138842,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -136149,11 +138867,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -136202,11 +138921,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -136230,8 +138950,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -136301,11 +139021,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -136313,15 +139034,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -136340,7 +139067,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -136422,7 +139150,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -136466,14 +139194,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -136512,7 +139241,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -136607,7 +139336,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -136723,12 +139452,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -136772,9 +139502,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -136801,25 +139531,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -136899,9 +139633,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -137010,11 +139744,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -137038,9 +139772,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -137066,20 +139801,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -137179,14 +139915,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -137201,11 +139940,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -137254,11 +139994,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -137282,8 +140023,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -137353,11 +140094,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -137365,15 +140107,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -137392,7 +140140,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -137474,7 +140223,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -137518,14 +140267,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -137564,7 +140314,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -137659,7 +140409,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -137775,12 +140525,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -137824,9 +140575,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -137853,25 +140604,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -137951,9 +140706,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -138062,11 +140817,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -138090,9 +140845,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -138118,20 +140874,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -138231,14 +140988,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -138253,11 +141013,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -138306,11 +141067,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -138334,8 +141096,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -138405,11 +141167,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -138417,15 +141180,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -138444,7 +141213,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -138526,7 +141296,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -138570,14 +141340,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -138616,7 +141387,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -138711,7 +141482,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -138827,12 +141598,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -138876,9 +141648,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -138905,25 +141677,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -139003,9 +141779,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -139114,11 +141890,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -139142,9 +141918,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -139170,20 +141947,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -139283,14 +142061,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -139305,11 +142086,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -139358,11 +142140,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -139386,8 +142169,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -139457,11 +142240,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -139469,15 +142253,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -139496,7 +142286,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -139578,7 +142369,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -139622,14 +142413,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -139668,7 +142460,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -139763,7 +142555,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -139879,12 +142671,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -139928,9 +142721,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -139957,25 +142750,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -140055,9 +142852,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -140166,11 +142963,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -140194,9 +142991,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -140222,20 +143020,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -140335,14 +143134,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -140357,11 +143159,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -140410,11 +143213,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -140438,8 +143242,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -140509,11 +143313,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -140521,15 +143326,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -140548,7 +143359,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -140630,7 +143442,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -140674,14 +143486,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -140720,7 +143533,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -140815,7 +143628,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -140931,12 +143744,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -140980,9 +143794,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -141009,25 +143823,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -141107,9 +143925,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -141218,11 +144036,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -141246,9 +144064,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -141274,20 +144093,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -141387,14 +144207,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -141409,11 +144232,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -141462,11 +144286,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -141490,8 +144315,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -141561,11 +144386,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -141573,15 +144399,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -141600,7 +144432,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -141682,7 +144515,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -141726,14 +144559,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -141772,7 +144606,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -141867,7 +144701,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -141983,12 +144817,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -142032,9 +144867,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -142061,25 +144896,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -142159,9 +144998,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -142270,11 +145109,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -142298,9 +145137,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -142326,20 +145166,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -142439,14 +145280,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -142461,11 +145305,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -142514,11 +145359,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -142542,8 +145388,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -142613,11 +145459,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -142625,15 +145472,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -142652,7 +145505,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -142734,7 +145588,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -142778,14 +145632,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -142824,7 +145679,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -142919,7 +145774,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -143035,12 +145890,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -143084,9 +145940,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -143113,25 +145969,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -143211,9 +146071,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -143322,11 +146182,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -143350,9 +146210,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -143378,20 +146239,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -143491,14 +146353,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -143513,11 +146378,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -143566,11 +146432,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -143594,8 +146461,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -143665,11 +146532,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -143677,15 +146545,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -143704,7 +146578,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -143786,7 +146661,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -143830,14 +146705,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -143876,7 +146752,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -143971,7 +146847,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -144087,12 +146963,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -144136,9 +147013,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -144165,25 +147042,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -144263,9 +147144,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -144374,11 +147255,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -144402,9 +147283,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -144430,20 +147312,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -144543,14 +147426,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -144565,11 +147451,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -144618,11 +147505,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -144646,8 +147534,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -144717,11 +147605,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -144729,15 +147618,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -144756,7 +147651,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -144838,7 +147734,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -144882,14 +147778,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -144928,7 +147825,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -145023,7 +147920,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -145139,12 +148036,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -145188,9 +148086,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -145217,25 +148115,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -145315,9 +148217,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -145426,11 +148328,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -145454,9 +148356,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -145482,20 +148385,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -145595,14 +148499,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -145617,11 +148524,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -145670,11 +148578,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -145698,8 +148607,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -145769,11 +148678,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -145781,15 +148691,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -145808,7 +148724,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -145890,7 +148807,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -145934,14 +148851,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -145980,7 +148898,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -146075,7 +148993,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -146191,12 +149109,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -146240,9 +149159,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -146269,25 +149188,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -146367,9 +149290,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -146478,11 +149401,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -146506,9 +149429,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -146534,20 +149458,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -146647,14 +149572,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -146669,11 +149597,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -146722,11 +149651,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -146750,8 +149680,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -146821,11 +149751,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -146833,15 +149764,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -146860,7 +149797,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -146942,7 +149880,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -146986,14 +149924,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -147032,7 +149971,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -147127,7 +150066,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -147243,12 +150182,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -147292,9 +150232,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -147321,25 +150261,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -147419,9 +150363,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -147530,11 +150474,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -147558,9 +150502,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -147586,20 +150531,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -147699,14 +150645,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -147721,11 +150670,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -147774,11 +150724,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -147802,8 +150753,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -147873,11 +150824,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -147885,15 +150837,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -147912,7 +150870,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -147994,7 +150953,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -148038,14 +150997,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -148084,7 +151044,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -148179,7 +151139,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -148295,12 +151255,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -148344,9 +151305,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -148373,25 +151334,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -148471,9 +151436,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -148582,11 +151547,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -148610,9 +151575,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -148638,20 +151604,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -148751,14 +151718,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -148773,11 +151743,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -148826,11 +151797,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -148854,8 +151826,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -148925,11 +151897,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -148937,15 +151910,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -148964,7 +151943,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -149046,7 +152026,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -149090,14 +152070,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -149136,7 +152117,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -149231,7 +152212,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -149347,12 +152328,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -149396,9 +152378,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -149425,25 +152407,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -149523,9 +152509,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -149634,11 +152620,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -149662,9 +152648,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -149690,20 +152677,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -149803,14 +152791,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -149825,11 +152816,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -149878,11 +152870,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -149906,8 +152899,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -149977,11 +152970,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -149989,15 +152983,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -150016,7 +153016,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -150098,7 +153099,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -150142,14 +153143,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -150188,7 +153190,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -150283,7 +153285,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -150399,12 +153401,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -150448,9 +153451,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -150477,25 +153480,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -150575,9 +153582,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -150686,11 +153693,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -150714,9 +153721,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -150742,20 +153750,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -150855,14 +153864,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -150877,11 +153889,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -150930,11 +153943,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -150958,8 +153972,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -151029,11 +154043,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -151041,15 +154056,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -151068,7 +154089,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -151150,7 +154172,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -151194,14 +154216,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -151240,7 +154263,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -151335,7 +154358,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -151451,12 +154474,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -151500,9 +154524,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -151529,25 +154553,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -151627,9 +154655,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -151738,11 +154766,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -151766,9 +154794,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -151794,20 +154823,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -151907,14 +154937,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -151929,11 +154962,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -151982,11 +155016,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -152010,8 +155045,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -152081,11 +155116,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -152093,15 +155129,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -152120,7 +155162,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -152202,7 +155245,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -152246,14 +155289,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -152292,7 +155336,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -152387,7 +155431,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -152503,12 +155547,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -152552,9 +155597,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -152581,25 +155626,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -152679,9 +155728,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -152790,11 +155839,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -152818,9 +155867,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -152846,20 +155896,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -152959,14 +156010,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -152981,11 +156035,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -153034,11 +156089,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -153062,8 +156118,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -153133,11 +156189,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -153145,15 +156202,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -153172,7 +156235,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -153254,7 +156318,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -153298,14 +156362,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -153344,7 +156409,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -153439,7 +156504,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -153555,12 +156620,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -153604,9 +156670,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -153633,25 +156699,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -153731,9 +156801,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -153842,11 +156912,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -153870,9 +156940,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -153898,20 +156969,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -154011,14 +157083,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -154033,11 +157108,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -154086,11 +157162,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -154114,8 +157191,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -154185,11 +157262,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -154197,15 +157275,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -154224,7 +157308,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -154306,7 +157391,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -154350,14 +157435,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -154396,7 +157482,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -154491,7 +157577,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -154607,12 +157693,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -154656,9 +157743,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -154685,25 +157772,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -154783,9 +157874,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -154894,11 +157985,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -154922,9 +158013,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -154950,20 +158042,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -155063,14 +158156,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -155085,11 +158181,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -155138,11 +158235,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -155166,8 +158264,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -155237,11 +158335,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -155249,15 +158348,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -155276,7 +158381,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -155358,7 +158464,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -155402,14 +158508,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -155448,7 +158555,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -155543,7 +158650,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -155659,12 +158766,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -155708,9 +158816,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -155737,25 +158845,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -155835,9 +158947,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -155946,11 +159058,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -155974,9 +159086,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -156002,20 +159115,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -156115,14 +159229,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -156137,11 +159254,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -156190,11 +159308,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -156218,8 +159337,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -156289,11 +159408,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -156301,15 +159421,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -156328,7 +159454,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -156410,7 +159537,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -156454,14 +159581,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -156500,7 +159628,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -156595,7 +159723,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -156711,12 +159839,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -156760,9 +159889,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -156789,25 +159918,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -156887,9 +160020,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -156998,11 +160131,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -157026,9 +160159,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -157054,20 +160188,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -157167,14 +160302,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -157189,11 +160327,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -157242,11 +160381,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -157270,8 +160410,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -157341,11 +160481,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -157353,15 +160494,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -157380,7 +160527,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -157462,7 +160610,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -157506,14 +160654,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -157552,7 +160701,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -157647,7 +160796,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -157763,12 +160912,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -157812,9 +160962,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -157841,25 +160991,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -157939,9 +161093,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -158050,11 +161204,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -158078,9 +161232,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -158106,20 +161261,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -158219,14 +161375,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -158241,11 +161400,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -158294,11 +161454,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -158322,8 +161483,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -158393,11 +161554,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -158405,15 +161567,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -158432,7 +161600,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -158514,7 +161683,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -158558,14 +161727,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -158604,7 +161774,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -158699,7 +161869,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -158815,12 +161985,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -158864,9 +162035,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -158893,25 +162064,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -158991,9 +162166,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -159102,11 +162277,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -159130,9 +162305,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -159158,20 +162334,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -159271,14 +162448,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -159293,11 +162473,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -159346,11 +162527,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -159374,8 +162556,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -159445,11 +162627,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -159457,15 +162640,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -159484,7 +162673,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -159566,7 +162756,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -159610,14 +162800,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -159656,7 +162847,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -159751,7 +162942,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -159867,12 +163058,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -159916,9 +163108,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -159945,25 +163137,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -160043,9 +163239,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -160154,11 +163350,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -160182,9 +163378,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -160210,20 +163407,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -160323,14 +163521,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -160345,11 +163546,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -160398,11 +163600,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -160426,8 +163629,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -160497,11 +163700,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -160509,15 +163713,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -160536,7 +163746,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -160618,7 +163829,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -160662,14 +163873,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -160708,7 +163920,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -160803,7 +164015,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -160919,12 +164131,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -160968,9 +164181,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -160997,25 +164210,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -161095,9 +164312,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -161206,11 +164423,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -161234,9 +164451,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -161262,20 +164480,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -161375,14 +164594,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -161397,11 +164619,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -161450,11 +164673,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -161478,8 +164702,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -161549,11 +164773,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -161561,15 +164786,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -161588,7 +164819,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -161670,7 +164902,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -161714,14 +164946,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -161760,7 +164993,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -161855,7 +165088,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -161971,12 +165204,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -162020,9 +165254,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -162049,25 +165283,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -162147,9 +165385,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -162258,11 +165496,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -162286,9 +165524,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -162314,20 +165553,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -162427,14 +165667,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -162449,11 +165692,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -162502,11 +165746,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -162530,8 +165775,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -162601,11 +165846,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -162613,15 +165859,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -162640,7 +165892,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -162722,7 +165975,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -162766,14 +166019,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -162812,7 +166066,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -162907,7 +166161,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -163023,12 +166277,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -163072,9 +166327,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -163101,25 +166356,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -163199,9 +166458,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -163310,11 +166569,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -163338,9 +166597,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -163366,20 +166626,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -163479,14 +166740,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -163501,11 +166765,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -163554,11 +166819,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -163582,8 +166848,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -163653,11 +166919,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -163665,15 +166932,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -163692,7 +166965,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -163774,7 +167048,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -163818,14 +167092,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -163864,7 +167139,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -163959,7 +167234,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -164075,12 +167350,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -164124,9 +167400,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -164153,25 +167429,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -164251,9 +167531,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -164362,11 +167642,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -164390,9 +167670,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -164418,20 +167699,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -164531,14 +167813,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -164553,11 +167838,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -164606,11 +167892,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -164634,8 +167921,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -164705,11 +167992,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -164717,15 +168005,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -164744,7 +168038,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -164826,7 +168121,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -164870,14 +168165,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -164916,7 +168212,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -165011,7 +168307,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -165127,12 +168423,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -165176,9 +168473,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -165205,25 +168502,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -165303,9 +168604,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -165414,11 +168715,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -165442,9 +168743,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -165470,20 +168772,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -165583,14 +168886,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -165605,11 +168911,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -165658,11 +168965,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -165686,8 +168994,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -165757,11 +169065,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -165769,15 +169078,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -165796,7 +169111,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -165878,7 +169194,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -165922,14 +169238,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -165968,7 +169285,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -166063,7 +169380,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -166179,12 +169496,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -166228,9 +169546,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -166257,25 +169575,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -166355,9 +169677,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -166466,11 +169788,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -166494,9 +169816,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -166522,20 +169845,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -166635,14 +169959,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -166657,11 +169984,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -166710,11 +170038,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -166738,8 +170067,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -166809,11 +170138,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -166821,15 +170151,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -166848,7 +170184,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -166930,7 +170267,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -166974,14 +170311,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -167020,7 +170358,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -167115,7 +170453,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -167231,12 +170569,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -167280,9 +170619,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -167309,25 +170648,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -167407,9 +170750,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -167518,11 +170861,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -167546,9 +170889,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -167574,20 +170918,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -167687,14 +171032,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -167709,11 +171057,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -167762,11 +171111,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -167790,8 +171140,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -167861,11 +171211,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -167873,15 +171224,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -167900,7 +171257,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -167982,7 +171340,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -168026,14 +171384,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -168072,7 +171431,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -168167,7 +171526,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -168283,12 +171642,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -168332,9 +171692,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -168361,25 +171721,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -168459,9 +171823,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -168570,11 +171934,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -168598,9 +171962,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -168626,20 +171991,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -168739,14 +172105,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -168761,11 +172130,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -168814,11 +172184,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -168842,8 +172213,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -168913,11 +172284,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -168925,15 +172297,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -168952,7 +172330,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -169034,7 +172413,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -169078,14 +172457,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -169124,7 +172504,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -169219,7 +172599,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -169335,12 +172715,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -169384,9 +172765,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -169413,25 +172794,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -169511,9 +172896,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -169622,11 +173007,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -169650,9 +173035,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -169678,20 +173064,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -169791,14 +173178,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -169813,11 +173203,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -169866,11 +173257,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -169894,8 +173286,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -169965,11 +173357,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -169977,15 +173370,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -170004,7 +173403,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -170086,7 +173486,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -170130,14 +173530,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -170176,7 +173577,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -170271,7 +173672,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -170387,12 +173788,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -170436,9 +173838,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -170465,25 +173867,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -170563,9 +173969,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -170674,11 +174080,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -170702,9 +174108,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -170730,20 +174137,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -170843,14 +174251,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -170865,11 +174276,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -170918,11 +174330,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -170946,8 +174359,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -171017,11 +174430,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -171029,15 +174443,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -171056,7 +174476,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -171138,7 +174559,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -171182,14 +174603,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -171228,7 +174650,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -171323,7 +174745,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -171439,12 +174861,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -171488,9 +174911,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -171517,25 +174940,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -171615,9 +175042,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -171726,11 +175153,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -171754,9 +175181,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -171782,20 +175210,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -171895,14 +175324,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -171917,11 +175349,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -171970,11 +175403,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -171998,8 +175432,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -172069,11 +175503,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -172081,15 +175516,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -172108,7 +175549,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -172190,7 +175632,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -172234,14 +175676,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -172280,7 +175723,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -172375,7 +175818,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -172491,12 +175934,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -172540,9 +175984,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -172569,25 +176013,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -172667,9 +176115,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -172778,11 +176226,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -172806,9 +176254,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -172834,20 +176283,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -172947,14 +176397,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -172969,11 +176422,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -173022,11 +176476,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -173050,8 +176505,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -173121,11 +176576,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -173133,15 +176589,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -173160,7 +176622,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -173242,7 +176705,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -173286,14 +176749,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -173332,7 +176796,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -173427,7 +176891,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -173543,12 +177007,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -173592,9 +177057,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -173621,25 +177086,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -173719,9 +177188,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -173830,11 +177299,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -173858,9 +177327,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -173886,20 +177356,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -173999,14 +177470,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -174021,11 +177495,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -174074,11 +177549,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -174102,8 +177578,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -174173,11 +177649,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -174185,15 +177662,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -174212,7 +177695,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -174294,7 +177778,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -174338,14 +177822,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -174384,7 +177869,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -174479,7 +177964,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -174595,12 +178080,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -174644,9 +178130,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -174673,25 +178159,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -174771,9 +178261,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -174882,11 +178372,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -174910,9 +178400,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -174938,20 +178429,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -175051,14 +178543,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -175073,11 +178568,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -175126,11 +178622,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -175154,8 +178651,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -175225,11 +178722,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -175237,15 +178735,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -175264,7 +178768,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -175346,7 +178851,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -175390,14 +178895,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -175436,7 +178942,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -175531,7 +179037,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -175647,12 +179153,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -175696,9 +179203,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -175725,25 +179232,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -175823,9 +179334,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -175934,11 +179445,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -175962,9 +179473,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -175990,20 +179502,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -176103,14 +179616,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -176125,11 +179641,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -176178,11 +179695,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -176206,8 +179724,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -176277,11 +179795,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -176289,15 +179808,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -176316,7 +179841,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -176398,7 +179924,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -176442,14 +179968,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -176488,7 +180015,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -176583,7 +180110,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -176699,12 +180226,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -176748,9 +180276,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -176777,25 +180305,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -176875,9 +180407,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -176986,11 +180518,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -177014,9 +180546,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -177042,20 +180575,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -177155,14 +180689,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -177177,11 +180714,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -177230,11 +180768,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -177258,8 +180797,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -177329,11 +180868,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -177341,15 +180881,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -177368,7 +180914,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -177450,7 +180997,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -177494,14 +181041,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -177540,7 +181088,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -177635,7 +181183,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -177751,12 +181299,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -177800,9 +181349,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -177829,25 +181378,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -177927,9 +181480,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -178038,11 +181591,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -178066,9 +181619,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -178094,20 +181648,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -178207,14 +181762,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -178229,11 +181787,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -178282,11 +181841,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -178310,8 +181870,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -178381,11 +181941,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -178393,15 +181954,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -178420,7 +181987,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -178502,7 +182070,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -178546,14 +182114,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -178592,7 +182161,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -178687,7 +182256,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -178803,12 +182372,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -178852,9 +182422,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -178881,25 +182451,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -178979,9 +182553,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -179090,11 +182664,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -179118,9 +182692,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -179146,20 +182721,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -179259,14 +182835,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -179281,11 +182860,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -179334,11 +182914,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -179362,8 +182943,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -179433,11 +183014,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -179445,15 +183027,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -179472,7 +183060,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -179554,7 +183143,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -179598,14 +183187,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -179644,7 +183234,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -179739,7 +183329,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -179855,12 +183445,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -179904,9 +183495,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -179933,25 +183524,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -180031,9 +183626,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -180142,11 +183737,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -180170,9 +183765,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -180198,20 +183794,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -180311,14 +183908,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -180333,11 +183933,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -180386,11 +183987,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -180414,8 +184016,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -180485,11 +184087,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -180497,15 +184100,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -180524,7 +184133,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -180606,7 +184216,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -180650,14 +184260,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -180696,7 +184307,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -180791,7 +184402,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -180907,12 +184518,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -180956,9 +184568,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -180985,25 +184597,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -181083,9 +184699,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -181194,11 +184810,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -181222,9 +184838,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -181250,20 +184867,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -181363,14 +184981,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -181385,11 +185006,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -181438,11 +185060,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -181466,8 +185089,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -181537,11 +185160,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -181549,15 +185173,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -181576,7 +185206,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -181658,7 +185289,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -181702,14 +185333,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -181748,7 +185380,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -181843,7 +185475,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -181959,12 +185591,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -182008,9 +185641,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -182037,25 +185670,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -182135,9 +185772,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -182246,11 +185883,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -182274,9 +185911,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -182302,20 +185940,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -182415,14 +186054,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -182437,11 +186079,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -182490,11 +186133,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -182518,8 +186162,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -182589,11 +186233,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -182601,15 +186246,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -182628,7 +186279,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -182710,7 +186362,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -182754,14 +186406,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -182800,7 +186453,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -182895,7 +186548,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -183011,12 +186664,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -183060,9 +186714,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -183089,25 +186743,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -183187,9 +186845,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -183298,11 +186956,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -183326,9 +186984,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -183354,20 +187013,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -183467,14 +187127,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -183489,11 +187152,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -183542,11 +187206,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -183570,8 +187235,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -183641,11 +187306,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -183653,15 +187319,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -183680,7 +187352,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -183762,7 +187435,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -183806,14 +187479,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -183852,7 +187526,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -183947,7 +187621,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -184063,12 +187737,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -184112,9 +187787,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -184141,25 +187816,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -184239,9 +187918,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -184350,11 +188029,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -184378,9 +188057,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -184406,20 +188086,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -184519,14 +188200,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -184541,11 +188225,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -184594,11 +188279,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -184622,8 +188308,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -184693,11 +188379,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -184705,15 +188392,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -184732,7 +188425,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -184814,7 +188508,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -184858,14 +188552,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -184904,7 +188599,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -184999,7 +188694,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -185115,12 +188810,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -185164,9 +188860,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -185193,25 +188889,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -185291,9 +188991,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -185402,11 +189102,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -185430,9 +189130,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -185458,20 +189159,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -185571,14 +189273,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -185593,11 +189298,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -185646,11 +189352,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -185674,8 +189381,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -185745,11 +189452,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -185757,15 +189465,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -185784,7 +189498,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -185866,7 +189581,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -185910,14 +189625,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -185956,7 +189672,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -186051,7 +189767,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -186167,12 +189883,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -186216,9 +189933,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -186245,25 +189962,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -186343,9 +190064,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -186454,11 +190175,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -186482,9 +190203,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -186510,20 +190232,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -186623,14 +190346,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -186645,11 +190371,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -186698,11 +190425,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -186726,8 +190454,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -186797,11 +190525,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -186809,15 +190538,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -186836,7 +190571,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -186918,7 +190654,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -186962,14 +190698,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -187008,7 +190745,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -187103,7 +190840,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -187219,12 +190956,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -187268,9 +191006,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -187297,25 +191035,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -187395,9 +191137,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -187506,11 +191248,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -187534,9 +191276,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -187562,20 +191305,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -187675,14 +191419,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -187697,11 +191444,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -187750,11 +191498,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -187778,8 +191527,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -187849,11 +191598,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -187861,15 +191611,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -187888,7 +191644,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -187970,7 +191727,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -188014,14 +191771,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -188060,7 +191818,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -188155,7 +191913,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -188271,12 +192029,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -188320,9 +192079,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -188349,25 +192108,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -188447,9 +192210,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -188558,11 +192321,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -188586,9 +192349,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -188614,20 +192378,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -188727,14 +192492,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -188749,11 +192517,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -188802,11 +192571,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -188830,8 +192600,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -188901,11 +192671,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -188913,15 +192684,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -188940,7 +192717,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -189022,7 +192800,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -189066,14 +192844,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -189112,7 +192891,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -189207,7 +192986,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -189323,12 +193102,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -189372,9 +193152,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -189401,25 +193181,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -189499,9 +193283,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -189610,11 +193394,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -189638,9 +193422,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -189666,20 +193451,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -189779,14 +193565,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -189801,11 +193590,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -189854,11 +193644,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -189882,8 +193673,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -189953,11 +193744,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -189965,15 +193757,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -189992,7 +193790,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -190074,7 +193873,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -190118,14 +193917,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -190164,7 +193964,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -190259,7 +194059,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -190375,12 +194175,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -190424,9 +194225,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -190453,25 +194254,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -190551,9 +194356,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -190662,11 +194467,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -190690,9 +194495,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -190718,20 +194524,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -190831,14 +194638,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -190853,11 +194663,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -190906,11 +194717,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -190934,8 +194746,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -191005,11 +194817,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -191017,15 +194830,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -191044,7 +194863,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -191126,7 +194946,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -191170,14 +194990,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -191216,7 +195037,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -191311,7 +195132,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -191427,12 +195248,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -191476,9 +195298,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -191505,25 +195327,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -191603,9 +195429,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -191714,11 +195540,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -191742,9 +195568,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -191770,20 +195597,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -191883,14 +195711,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -191905,11 +195736,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -191958,11 +195790,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -191986,8 +195819,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -192057,11 +195890,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -192069,15 +195903,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -192096,7 +195936,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -192178,7 +196019,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -192222,14 +196063,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -192268,7 +196110,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -192363,7 +196205,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -192479,12 +196321,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -192528,9 +196371,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -192557,25 +196400,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -192655,9 +196502,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -192766,11 +196613,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -192794,9 +196641,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -192822,20 +196670,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -192935,14 +196784,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -192957,11 +196809,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -193010,11 +196863,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -193038,8 +196892,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -193109,11 +196963,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -193121,15 +196976,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -193148,7 +197009,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -193230,7 +197092,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -193274,14 +197136,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -193320,7 +197183,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -193415,7 +197278,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -193531,12 +197394,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -193580,9 +197444,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -193609,25 +197473,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -193707,9 +197575,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -193818,11 +197686,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -193846,9 +197714,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -193874,20 +197743,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -193987,14 +197857,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -194009,11 +197882,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -194062,11 +197936,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -194090,8 +197965,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -194161,11 +198036,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -194173,15 +198049,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -194200,7 +198082,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -194282,7 +198165,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -194326,14 +198209,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -194372,7 +198256,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -194467,7 +198351,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -194583,12 +198467,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -194632,9 +198517,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -194661,25 +198546,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -194759,9 +198648,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -194870,11 +198759,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -194898,9 +198787,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -194926,20 +198816,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -195039,14 +198930,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -195061,11 +198955,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -195114,11 +199009,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -195142,8 +199038,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -195213,11 +199109,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -195225,15 +199122,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -195252,7 +199155,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -195334,7 +199238,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -195378,14 +199282,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -195424,7 +199329,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -195519,7 +199424,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -195635,12 +199540,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -195684,9 +199590,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -195713,25 +199619,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -195811,9 +199721,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -195922,11 +199832,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -195950,9 +199860,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -195978,20 +199889,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -196091,14 +200003,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -196113,11 +200028,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -196166,11 +200082,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -196194,8 +200111,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -196265,11 +200182,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -196277,15 +200195,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -196304,7 +200228,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -196386,7 +200311,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -196430,14 +200355,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -196476,7 +200402,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -196571,7 +200497,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -196687,12 +200613,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -196736,9 +200663,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -196765,25 +200692,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -196863,9 +200794,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -196974,11 +200905,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -197002,9 +200933,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -197030,20 +200962,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -197143,14 +201076,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -197165,11 +201101,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -197218,11 +201155,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -197246,8 +201184,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -197317,11 +201255,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -197329,15 +201268,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -197356,7 +201301,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -197438,7 +201384,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -197482,14 +201428,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -197528,7 +201475,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -197623,7 +201570,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -197739,12 +201686,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -197788,9 +201736,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -197817,25 +201765,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -197915,9 +201867,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -198026,11 +201978,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -198054,9 +202006,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -198082,20 +202035,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -198195,14 +202149,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -198217,11 +202174,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -198270,11 +202228,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -198298,8 +202257,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -198369,11 +202328,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -198381,15 +202341,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -198408,7 +202374,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -198490,7 +202457,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -198534,14 +202501,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -198580,7 +202548,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -198675,7 +202643,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -198791,12 +202759,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -198840,9 +202809,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -198869,25 +202838,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -198967,9 +202940,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -199078,11 +203051,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -199106,9 +203079,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -199134,20 +203108,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -199247,14 +203222,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -199269,11 +203247,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -199322,11 +203301,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -199350,8 +203330,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -199421,11 +203401,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -199433,15 +203414,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -199460,7 +203447,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -199542,7 +203530,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -199586,14 +203574,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -199632,7 +203621,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -199727,7 +203716,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -199843,12 +203832,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -199892,9 +203882,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -199921,25 +203911,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -200019,9 +204013,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -200130,11 +204124,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -200158,9 +204152,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -200186,20 +204181,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -200299,14 +204295,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -200321,11 +204320,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -200374,11 +204374,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -200402,8 +204403,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -200473,11 +204474,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -200485,15 +204487,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -200512,7 +204520,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -200594,7 +204603,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -200638,14 +204647,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -200684,7 +204694,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -200779,7 +204789,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -200895,12 +204905,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -200944,9 +204955,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -200973,25 +204984,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -201071,9 +205086,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -201182,11 +205197,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -201210,9 +205225,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -201238,20 +205254,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -201351,14 +205368,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -201373,11 +205393,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -201426,11 +205447,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -201454,8 +205476,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -201525,11 +205547,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -201537,15 +205560,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -201564,7 +205593,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -201646,7 +205676,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -201690,14 +205720,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -201736,7 +205767,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -201831,7 +205862,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -201947,12 +205978,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -201996,9 +206028,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -202025,25 +206057,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -202123,9 +206159,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -202234,11 +206270,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -202262,9 +206298,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -202290,20 +206327,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -202403,14 +206441,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -202425,11 +206466,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -202478,11 +206520,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -202506,8 +206549,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -202577,11 +206620,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -202589,15 +206633,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -202616,7 +206666,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -202698,7 +206749,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -202742,14 +206793,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -202788,7 +206840,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -202883,7 +206935,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -202999,12 +207051,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -203048,9 +207101,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -203077,25 +207130,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -203175,9 +207232,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -203286,11 +207343,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -203314,9 +207371,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -203342,20 +207400,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -203455,14 +207514,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -203477,11 +207539,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -203530,11 +207593,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -203558,8 +207622,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -203629,11 +207693,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -203641,15 +207706,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -203668,7 +207739,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -203750,7 +207822,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -203794,14 +207866,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -203840,7 +207913,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -203935,7 +208008,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -204051,12 +208124,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -204100,9 +208174,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -204129,25 +208203,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -204227,9 +208305,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -204338,11 +208416,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -204366,9 +208444,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -204394,20 +208473,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -204507,14 +208587,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -204529,11 +208612,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -204582,11 +208666,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -204610,8 +208695,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -204681,11 +208766,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -204693,15 +208779,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -204720,7 +208812,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -204802,7 +208895,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -204846,14 +208939,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -204892,7 +208986,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -204987,7 +209081,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -205103,12 +209197,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -205152,9 +209247,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -205181,25 +209276,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -205279,9 +209378,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -205390,11 +209489,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -205418,9 +209517,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -205446,20 +209546,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -205559,14 +209660,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -205581,11 +209685,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -205634,11 +209739,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -205662,8 +209768,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -205733,11 +209839,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -205745,15 +209852,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -205772,7 +209885,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -205854,7 +209968,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -205898,14 +210012,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -205944,7 +210059,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -206039,7 +210154,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -206155,12 +210270,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -206204,9 +210320,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -206233,25 +210349,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -206331,9 +210451,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -206442,11 +210562,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -206470,9 +210590,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -206498,20 +210619,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -206611,14 +210733,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -206633,11 +210758,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -206686,11 +210812,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -206714,8 +210841,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -206785,11 +210912,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -206797,15 +210925,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -206824,7 +210958,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -206906,7 +211041,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -206950,14 +211085,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -206996,7 +211132,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -207091,7 +211227,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -207207,12 +211343,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -207256,9 +211393,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -207285,25 +211422,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -207383,9 +211524,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -207494,11 +211635,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -207522,9 +211663,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -207550,20 +211692,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -207663,14 +211806,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -207685,11 +211831,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -207738,11 +211885,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -207766,8 +211914,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -207837,11 +211985,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -207849,15 +211998,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -207876,7 +212031,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -207958,7 +212114,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -208002,14 +212158,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -208048,7 +212205,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -208143,7 +212300,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -208259,12 +212416,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -208308,9 +212466,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -208337,25 +212495,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -208435,9 +212597,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -208546,11 +212708,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -208574,9 +212736,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -208602,20 +212765,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -208715,14 +212879,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -208737,11 +212904,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -208790,11 +212958,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -208818,8 +212987,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -208889,11 +213058,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -208901,15 +213071,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -208928,7 +213104,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -209010,7 +213187,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -209054,14 +213231,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -209100,7 +213278,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -209195,7 +213373,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -209311,12 +213489,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -209360,9 +213539,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -209389,25 +213568,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -209487,9 +213670,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -209598,11 +213781,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -209626,9 +213809,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -209654,20 +213838,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -209767,14 +213952,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -209789,11 +213977,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -209842,11 +214031,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -209870,8 +214060,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -209941,11 +214131,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -209953,15 +214144,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -209980,7 +214177,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -210062,7 +214260,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -210106,14 +214304,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -210152,7 +214351,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -210247,7 +214446,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -210363,12 +214562,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -210412,9 +214612,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -210441,25 +214641,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -210539,9 +214743,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -210650,11 +214854,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -210678,9 +214882,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -210706,20 +214911,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -210819,14 +215025,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -210841,11 +215050,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -210894,11 +215104,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -210922,8 +215133,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -210993,11 +215204,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -211005,15 +215217,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -211032,7 +215250,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -211114,7 +215333,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -211158,14 +215377,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -211204,7 +215424,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -211299,7 +215519,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -211415,12 +215635,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -211464,9 +215685,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -211493,25 +215714,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -211591,9 +215816,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -211702,11 +215927,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -211730,9 +215955,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -211758,20 +215984,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -211871,14 +216098,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -211893,11 +216123,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -211946,11 +216177,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -211974,8 +216206,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -212045,11 +216277,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -212057,15 +216290,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -212084,7 +216323,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -212166,7 +216406,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -212210,14 +216450,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -212256,7 +216497,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -212351,7 +216592,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -212467,12 +216708,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -212516,9 +216758,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -212545,25 +216787,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -212643,9 +216889,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -212754,11 +217000,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -212782,9 +217028,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -212810,20 +217057,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -212923,14 +217171,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -212945,11 +217196,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -212998,11 +217250,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -213026,8 +217279,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -213097,11 +217350,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -213109,15 +217363,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -213136,7 +217396,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -213218,7 +217479,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -213262,14 +217523,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -213308,7 +217570,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -213403,7 +217665,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -213519,12 +217781,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -213568,9 +217831,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -213597,25 +217860,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -213695,9 +217962,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -213806,11 +218073,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -213834,9 +218101,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -213862,20 +218130,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -213975,14 +218244,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -213997,11 +218269,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -214050,11 +218323,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -214078,8 +218352,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -214149,11 +218423,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -214161,15 +218436,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -214188,7 +218469,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -214270,7 +218552,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -214314,14 +218596,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -214360,7 +218643,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -214455,7 +218738,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -214571,12 +218854,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -214620,9 +218904,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -214649,25 +218933,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -214747,9 +219035,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -214858,11 +219146,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -214886,9 +219174,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -214914,20 +219203,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -215027,14 +219317,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -215049,11 +219342,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -215102,11 +219396,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -215130,8 +219425,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -215201,11 +219496,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -215213,15 +219509,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -215240,7 +219542,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -215322,7 +219625,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -215366,14 +219669,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -215412,7 +219716,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -215507,7 +219811,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -215623,12 +219927,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -215672,9 +219977,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -215701,25 +220006,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -215799,9 +220108,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -215910,11 +220219,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -215938,9 +220247,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -215966,20 +220276,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -216079,14 +220390,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -216101,11 +220415,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -216154,11 +220469,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -216182,8 +220498,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -216253,11 +220569,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -216265,15 +220582,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -216292,7 +220615,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -216374,7 +220698,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -216418,14 +220742,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -216464,7 +220789,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -216559,7 +220884,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -216675,12 +221000,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -216724,9 +221050,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -216753,25 +221079,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -216851,9 +221181,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -216962,11 +221292,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -216990,9 +221320,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -217018,20 +221349,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -217131,14 +221463,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -217153,11 +221488,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -217206,11 +221542,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -217234,8 +221571,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -217305,11 +221642,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -217317,15 +221655,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -217344,7 +221688,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -217426,7 +221771,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -217470,14 +221815,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -217516,7 +221862,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -217611,7 +221957,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -217727,12 +222073,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -217776,9 +222123,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -217805,25 +222152,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -217903,9 +222254,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -218014,11 +222365,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -218042,9 +222393,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -218070,20 +222422,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -218183,14 +222536,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -218205,11 +222561,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -218258,11 +222615,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -218286,8 +222644,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -218357,11 +222715,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -218369,15 +222728,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -218396,7 +222761,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -218478,7 +222844,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -218522,14 +222888,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -218568,7 +222935,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -218663,7 +223030,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -218779,12 +223146,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -218828,9 +223196,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -218857,25 +223225,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -218955,9 +223327,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -219066,11 +223438,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -219094,9 +223466,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -219122,20 +223495,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -219235,14 +223609,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -219257,11 +223634,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -219310,11 +223688,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -219338,8 +223717,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -219409,11 +223788,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -219421,15 +223801,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -219448,7 +223834,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -219530,7 +223917,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -219574,14 +223961,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -219620,7 +224008,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -219715,7 +224103,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -219831,12 +224219,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -219880,9 +224269,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -219909,25 +224298,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -220007,9 +224400,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -220118,11 +224511,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -220146,9 +224539,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -220174,20 +224568,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -220287,14 +224682,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -220309,11 +224707,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -220362,11 +224761,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -220390,8 +224790,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -220461,11 +224861,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -220473,15 +224874,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -220500,7 +224907,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -220582,7 +224990,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -220626,14 +225034,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -220672,7 +225081,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -220767,7 +225176,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -220883,12 +225292,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -220932,9 +225342,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -220961,25 +225371,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -221059,9 +225473,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -221170,11 +225584,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -221198,9 +225612,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -221226,20 +225641,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -221339,14 +225755,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -221361,11 +225780,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -221414,11 +225834,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -221442,8 +225863,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -221513,11 +225934,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -221525,15 +225947,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -221552,7 +225980,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -221634,7 +226063,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -221678,14 +226107,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -221724,7 +226154,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -221819,7 +226249,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -221935,12 +226365,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -221984,9 +226415,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -222013,25 +226444,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -222111,9 +226546,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -222222,11 +226657,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -222250,9 +226685,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -222278,20 +226714,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -222391,14 +226828,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -222413,11 +226853,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -222466,11 +226907,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -222494,8 +226936,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -222565,11 +227007,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -222577,15 +227020,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -222604,7 +227053,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -222686,7 +227136,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -222730,14 +227180,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -222776,7 +227227,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -222871,7 +227322,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -222987,12 +227438,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -223036,9 +227488,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -223065,25 +227517,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -223163,9 +227619,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -223274,11 +227730,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -223302,9 +227758,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -223330,20 +227787,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -223443,14 +227901,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -223465,11 +227926,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -223518,11 +227980,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -223546,8 +228009,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -223617,11 +228080,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -223629,15 +228093,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -223656,7 +228126,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -223738,7 +228209,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -223782,14 +228253,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -223828,7 +228300,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -223923,7 +228395,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -224039,12 +228511,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -224088,9 +228561,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -224117,25 +228590,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -224215,9 +228692,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -224326,11 +228803,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -224354,9 +228831,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -224382,20 +228860,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -224495,14 +228974,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -224517,11 +228999,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -224570,11 +229053,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -224598,8 +229082,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -224669,11 +229153,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -224681,15 +229166,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -224708,7 +229199,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -224790,7 +229282,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -224834,14 +229326,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -224880,7 +229373,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -224975,7 +229468,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -225091,12 +229584,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -225140,9 +229634,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -225169,25 +229663,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -225267,9 +229765,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -225378,11 +229876,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -225406,9 +229904,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -225434,20 +229933,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -225547,14 +230047,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -225569,11 +230072,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -225622,11 +230126,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -225650,8 +230155,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -225721,11 +230226,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -225733,15 +230239,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -225760,7 +230272,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -225842,7 +230355,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -225886,14 +230399,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -225932,7 +230446,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -226027,7 +230541,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -226143,12 +230657,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -226192,9 +230707,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -226221,25 +230736,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -226319,9 +230838,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -226430,11 +230949,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -226458,9 +230977,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -226486,20 +231006,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -226599,14 +231120,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -226621,11 +231145,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -226674,11 +231199,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -226702,8 +231228,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -226773,11 +231299,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -226785,15 +231312,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -226812,7 +231345,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -226894,7 +231428,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -226938,14 +231472,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -226984,7 +231519,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -227079,7 +231614,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -227195,12 +231730,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -227244,9 +231780,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -227273,25 +231809,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -227371,9 +231911,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -227482,11 +232022,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -227510,9 +232050,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -227538,20 +232079,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -227651,14 +232193,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -227673,11 +232218,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -227726,11 +232272,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -227754,8 +232301,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -227825,11 +232372,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -227837,15 +232385,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -227864,7 +232418,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -227946,7 +232501,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -227990,14 +232545,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -228036,7 +232592,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -228131,7 +232687,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -228247,12 +232803,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -228296,9 +232853,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -228325,25 +232882,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -228423,9 +232984,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -228534,11 +233095,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -228562,9 +233123,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -228590,20 +233152,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -228703,14 +233266,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -228725,11 +233291,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -228778,11 +233345,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -228806,8 +233374,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -228877,11 +233445,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -228889,15 +233458,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -228916,7 +233491,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -228998,7 +233574,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -229042,14 +233618,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -229088,7 +233665,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -229183,7 +233760,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -229299,12 +233876,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -229348,9 +233926,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -229377,25 +233955,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -229475,9 +234057,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -229586,11 +234168,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -229614,9 +234196,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -229642,20 +234225,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -229755,14 +234339,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -229777,11 +234364,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -229830,11 +234418,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -229858,8 +234447,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -229929,11 +234518,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -229941,15 +234531,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -229968,7 +234564,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -230050,7 +234647,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -230094,14 +234691,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -230140,7 +234738,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -230235,7 +234833,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -230351,12 +234949,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -230400,9 +234999,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -230429,25 +235028,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -230527,9 +235130,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -230638,11 +235241,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -230666,9 +235269,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -230694,20 +235298,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -230807,14 +235412,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -230829,11 +235437,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -230882,11 +235491,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -230910,8 +235520,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -230981,11 +235591,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -230993,15 +235604,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -231020,7 +235637,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -231102,7 +235720,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -231146,14 +235764,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -231192,7 +235811,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -231287,7 +235906,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -231403,12 +236022,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -231452,9 +236072,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -231481,25 +236101,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -231579,9 +236203,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -231690,11 +236314,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -231718,9 +236342,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -231746,20 +236371,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -231859,14 +236485,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -231881,11 +236510,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -231934,11 +236564,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -231962,8 +236593,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -232033,11 +236664,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -232045,15 +236677,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -232072,7 +236710,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -232154,7 +236793,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -232198,14 +236837,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -232244,7 +236884,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -232339,7 +236979,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -232455,12 +237095,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -232504,9 +237145,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -232533,25 +237174,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -232631,9 +237276,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -232742,11 +237387,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -232770,9 +237415,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -232798,20 +237444,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -232911,14 +237558,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -232933,11 +237583,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -232986,11 +237637,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -233014,8 +237666,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -233085,11 +237737,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -233097,15 +237750,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -233124,7 +237783,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -233206,7 +237866,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -233250,14 +237910,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -233296,7 +237957,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -233391,7 +238052,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -233507,12 +238168,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -233556,9 +238218,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -233585,25 +238247,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -233683,9 +238349,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -233794,11 +238460,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -233822,9 +238488,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -233850,20 +238517,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -233963,14 +238631,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -233985,11 +238656,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -234038,11 +238710,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -234066,8 +238739,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -234137,11 +238810,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -234149,15 +238823,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -234176,7 +238856,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -234258,7 +238939,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -234302,14 +238983,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -234348,7 +239030,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -234443,7 +239125,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -234559,12 +239241,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -234608,9 +239291,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -234637,25 +239320,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -234735,9 +239422,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -234846,11 +239533,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -234874,9 +239561,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -234902,20 +239590,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -235015,14 +239704,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -235037,11 +239729,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -235090,11 +239783,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -235118,8 +239812,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -235189,11 +239883,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -235201,15 +239896,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -235228,7 +239929,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -235310,7 +240012,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -235354,14 +240056,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -235400,7 +240103,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -235495,7 +240198,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -235611,12 +240314,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -235660,9 +240364,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -235689,25 +240393,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -235787,9 +240495,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -235898,11 +240606,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -235926,9 +240634,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -235954,20 +240663,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -236067,14 +240777,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -236089,11 +240802,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -236142,11 +240856,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -236170,8 +240885,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -236241,11 +240956,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -236253,15 +240969,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -236280,7 +241002,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -236362,7 +241085,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -236406,14 +241129,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -236452,7 +241176,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -236547,7 +241271,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -236663,12 +241387,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -236712,9 +241437,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -236741,25 +241466,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -236839,9 +241568,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -236950,11 +241679,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -236978,9 +241707,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -237006,20 +241736,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -237119,14 +241850,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -237141,11 +241875,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -237194,11 +241929,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -237222,8 +241958,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -237293,11 +242029,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -237305,15 +242042,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -237332,7 +242075,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -237414,7 +242158,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -237458,14 +242202,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -237504,7 +242249,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -237599,7 +242344,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -237715,12 +242460,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -237764,9 +242510,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -237793,25 +242539,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -237891,9 +242641,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -238002,11 +242752,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -238030,9 +242780,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -238058,20 +242809,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -238171,14 +242923,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -238193,11 +242948,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -238246,11 +243002,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -238274,8 +243031,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -238345,11 +243102,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -238357,15 +243115,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -238384,7 +243148,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -238466,7 +243231,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -238510,14 +243275,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -238556,7 +243322,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -238651,7 +243417,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -238767,12 +243533,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -238816,9 +243583,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -238845,25 +243612,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -238943,9 +243714,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -239054,11 +243825,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -239082,9 +243853,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -239110,20 +243882,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -239223,14 +243996,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -239245,11 +244021,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -239298,11 +244075,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -239326,8 +244104,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -239397,11 +244175,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -239409,15 +244188,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -239436,7 +244221,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -239518,7 +244304,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -239562,14 +244348,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -239608,7 +244395,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -239703,7 +244490,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -239819,12 +244606,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -239868,9 +244656,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -239897,25 +244685,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -239995,9 +244787,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -240106,11 +244898,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -240134,9 +244926,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -240162,20 +244955,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -240275,14 +245069,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -240297,11 +245094,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -240350,11 +245148,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -240378,8 +245177,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -240449,11 +245248,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -240461,15 +245261,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -240488,7 +245294,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -240570,7 +245377,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -240614,14 +245421,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -240660,7 +245468,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -240755,7 +245563,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -240871,12 +245679,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -240920,9 +245729,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -240949,25 +245758,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -241047,9 +245860,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -241158,11 +245971,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -241186,9 +245999,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -241214,20 +246028,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -241327,14 +246142,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -241349,11 +246167,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -241402,11 +246221,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -241430,8 +246250,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -241501,11 +246321,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -241513,15 +246334,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -241540,7 +246367,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -241622,7 +246450,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -241666,14 +246494,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -241712,7 +246541,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -241807,7 +246636,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -241923,12 +246752,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -241972,9 +246802,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -242001,25 +246831,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -242099,9 +246933,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -242210,11 +247044,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -242238,9 +247072,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -242266,20 +247101,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -242379,14 +247215,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -242401,11 +247240,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -242454,11 +247294,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -242482,8 +247323,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -242553,11 +247394,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -242565,15 +247407,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -242592,7 +247440,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -242674,7 +247523,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -242718,14 +247567,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -242764,7 +247614,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -242859,7 +247709,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -242975,12 +247825,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -243024,9 +247875,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -243053,25 +247904,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -243151,9 +248006,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -243262,11 +248117,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -243290,9 +248145,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -243318,20 +248174,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -243431,14 +248288,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -243453,11 +248313,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -243506,11 +248367,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -243534,8 +248396,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -243605,11 +248467,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -243617,15 +248480,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -243644,7 +248513,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -243726,7 +248596,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -243770,14 +248640,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -243816,7 +248687,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -243911,7 +248782,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -244027,12 +248898,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -244076,9 +248948,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -244105,25 +248977,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -244203,9 +249079,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -244314,11 +249190,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -244342,9 +249218,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -244370,20 +249247,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -244483,14 +249361,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -244505,11 +249386,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -244558,11 +249440,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -244586,8 +249469,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -244657,11 +249540,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -244669,15 +249553,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -244696,7 +249586,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -244778,7 +249669,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -244822,14 +249713,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -244868,7 +249760,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -244963,7 +249855,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -245079,12 +249971,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -245128,9 +250021,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -245157,25 +250050,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -245255,9 +250152,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -245366,11 +250263,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -245394,9 +250291,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -245422,20 +250320,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -245535,14 +250434,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -245557,11 +250459,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -245610,11 +250513,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -245638,8 +250542,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -245709,11 +250613,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -245721,15 +250626,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -245748,7 +250659,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -245830,7 +250742,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -245874,14 +250786,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -245920,7 +250833,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -246015,7 +250928,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -246131,12 +251044,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -246180,9 +251094,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -246209,25 +251123,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -246307,9 +251225,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -246418,11 +251336,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -246446,9 +251364,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -246474,20 +251393,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -246587,14 +251507,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -246609,11 +251532,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -246662,11 +251586,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -246690,8 +251615,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -246761,11 +251686,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -246773,15 +251699,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -246800,7 +251732,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -246882,7 +251815,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -246926,14 +251859,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -246972,7 +251906,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -247067,7 +252001,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -247183,12 +252117,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -247232,9 +252167,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -247261,25 +252196,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -247359,9 +252298,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -247470,11 +252409,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -247498,9 +252437,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -247526,20 +252466,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -247639,14 +252580,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -247661,11 +252605,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -247714,11 +252659,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -247742,8 +252688,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -247813,11 +252759,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -247825,15 +252772,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -247852,7 +252805,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -247934,7 +252888,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -247978,14 +252932,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -248024,7 +252979,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -248119,7 +253074,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -248235,12 +253190,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -248284,9 +253240,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -248313,25 +253269,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -248411,9 +253371,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -248522,11 +253482,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -248550,9 +253510,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -248578,20 +253539,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -248691,14 +253653,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -248713,11 +253678,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -248766,11 +253732,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -248794,8 +253761,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -248865,11 +253832,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -248877,15 +253845,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -248904,7 +253878,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -248986,7 +253961,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -249030,14 +254005,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -249076,7 +254052,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -249171,7 +254147,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -249287,12 +254263,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -249336,9 +254313,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -249365,25 +254342,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -249463,9 +254444,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -249574,11 +254555,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -249602,9 +254583,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -249630,20 +254612,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -249743,14 +254726,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -249765,11 +254751,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -249818,11 +254805,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -249846,8 +254834,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -249917,11 +254905,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -249929,15 +254918,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -249956,7 +254951,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -250038,7 +255034,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -250082,14 +255078,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -250128,7 +255125,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -250223,7 +255220,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -250339,12 +255336,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -250388,9 +255386,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -250417,25 +255415,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -250515,9 +255517,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -250626,11 +255628,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -250654,9 +255656,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -250682,20 +255685,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -250795,14 +255799,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -250817,11 +255824,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -250870,11 +255878,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -250898,8 +255907,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -250969,11 +255978,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -250981,15 +255991,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -251008,7 +256024,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -251090,7 +256107,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -251134,14 +256151,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -251180,7 +256198,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -251275,7 +256293,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -251391,12 +256409,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -251440,9 +256459,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -251469,25 +256488,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -251567,9 +256590,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -251678,11 +256701,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -251706,9 +256729,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -251734,20 +256758,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -251847,14 +256872,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -251869,11 +256897,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -251922,11 +256951,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -251950,8 +256980,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -252021,11 +257051,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -252033,15 +257064,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -252060,7 +257097,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -252142,7 +257180,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -252186,14 +257224,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -252232,7 +257271,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -252327,7 +257366,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -252443,12 +257482,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -252492,9 +257532,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -252521,25 +257561,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -252619,9 +257663,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -252730,11 +257774,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -252758,9 +257802,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -252786,20 +257831,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -252899,14 +257945,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -252921,11 +257970,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -252974,11 +258024,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -253002,8 +258053,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -253073,11 +258124,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -253085,15 +258137,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -253112,7 +258170,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -253194,7 +258253,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -253238,14 +258297,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -253284,7 +258344,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -253379,7 +258439,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -253495,12 +258555,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -253544,9 +258605,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -253573,25 +258634,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -253671,9 +258736,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -253782,11 +258847,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -253810,9 +258875,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -253838,20 +258904,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -253951,14 +259018,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -253973,11 +259043,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -254026,11 +259097,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -254054,8 +259126,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -254125,11 +259197,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -254137,15 +259210,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -254164,7 +259243,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -254246,7 +259326,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -254290,14 +259370,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -254336,7 +259417,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -254431,7 +259512,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -254547,12 +259628,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -254596,9 +259678,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -254625,25 +259707,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -254723,9 +259809,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -254834,11 +259920,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -254862,9 +259948,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -254890,20 +259977,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -255003,14 +260091,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -255025,11 +260116,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -255078,11 +260170,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -255106,8 +260199,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -255177,11 +260270,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -255189,15 +260283,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -255216,7 +260316,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -255298,7 +260399,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -255342,14 +260443,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -255388,7 +260490,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -255483,7 +260585,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -255599,12 +260701,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -255648,9 +260751,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -255677,25 +260780,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -255775,9 +260882,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -255886,11 +260993,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -255914,9 +261021,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -255942,20 +261050,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -256055,14 +261164,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -256077,11 +261189,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -256130,11 +261243,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -256158,8 +261272,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -256229,11 +261343,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -256241,15 +261356,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -256268,7 +261389,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -256350,7 +261472,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -256394,14 +261516,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -256440,7 +261563,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -256535,7 +261658,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -256651,12 +261774,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -256700,9 +261824,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -256729,25 +261853,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -256827,9 +261955,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -256938,11 +262066,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -256966,9 +262094,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -256994,20 +262123,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -257107,14 +262237,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -257129,11 +262262,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -257182,11 +262316,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -257210,8 +262345,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -257281,11 +262416,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -257293,15 +262429,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -257320,7 +262462,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -257402,7 +262545,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -257446,14 +262589,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -257492,7 +262636,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -257587,7 +262731,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -257703,12 +262847,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -257752,9 +262897,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -257781,25 +262926,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -257879,9 +263028,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -257990,11 +263139,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -258018,9 +263167,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -258046,20 +263196,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -258159,14 +263310,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -258181,11 +263335,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -258234,11 +263389,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -258262,8 +263418,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -258333,11 +263489,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -258345,15 +263502,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -258372,7 +263535,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -258454,7 +263618,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -258498,14 +263662,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -258544,7 +263709,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -258639,7 +263804,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -258755,12 +263920,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -258804,9 +263970,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -258833,25 +263999,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -258931,9 +264101,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -259042,11 +264212,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -259070,9 +264240,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -259098,20 +264269,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -259211,14 +264383,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -259233,11 +264408,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -259286,11 +264462,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -259314,8 +264491,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -259385,11 +264562,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -259397,15 +264575,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -259424,7 +264608,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -259506,7 +264691,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -259550,14 +264735,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -259596,7 +264782,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -259691,7 +264877,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -259807,12 +264993,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -259856,9 +265043,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -259885,25 +265072,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -259983,9 +265174,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -260094,11 +265285,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -260122,9 +265313,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -260150,20 +265342,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -260263,14 +265456,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -260285,11 +265481,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -260338,11 +265535,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -260366,8 +265564,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -260437,11 +265635,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -260449,15 +265648,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -260476,7 +265681,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -260558,7 +265764,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -260602,14 +265808,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -260648,7 +265855,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -260743,7 +265950,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -260859,12 +266066,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -260908,9 +266116,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -260937,25 +266145,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -261035,9 +266247,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -261146,11 +266358,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -261174,9 +266386,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -261202,20 +266415,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -261315,14 +266529,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -261337,11 +266554,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -261390,11 +266608,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -261418,8 +266637,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -261489,11 +266708,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -261501,15 +266721,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -261528,7 +266754,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -261610,7 +266837,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -261654,14 +266881,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -261700,7 +266928,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -261795,7 +267023,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -261911,12 +267139,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -261960,9 +267189,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -261989,25 +267218,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -262087,9 +267320,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -262198,11 +267431,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -262226,9 +267459,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -262254,20 +267488,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -262367,14 +267602,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -262389,11 +267627,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -262442,11 +267681,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -262470,8 +267710,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -262541,11 +267781,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -262553,15 +267794,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -262580,7 +267827,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -262662,7 +267910,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -262706,14 +267954,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -262752,7 +268001,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -262847,7 +268096,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -262963,12 +268212,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -263012,9 +268262,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -263041,25 +268291,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -263139,9 +268393,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -263250,11 +268504,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -263278,9 +268532,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -263306,20 +268561,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -263419,14 +268675,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -263441,11 +268700,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -263494,11 +268754,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -263522,8 +268783,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -263593,11 +268854,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -263605,15 +268867,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -263632,7 +268900,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -263714,7 +268983,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -263758,14 +269027,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -263804,7 +269074,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -263899,7 +269169,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -264015,12 +269285,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -264064,9 +269335,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -264093,25 +269364,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -264191,9 +269466,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -264302,11 +269577,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -264330,9 +269605,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -264358,20 +269634,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -264471,14 +269748,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -264493,11 +269773,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -264546,11 +269827,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -264574,8 +269856,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -264645,11 +269927,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -264657,15 +269940,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -264684,7 +269973,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -264766,7 +270056,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -264810,14 +270100,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -264856,7 +270147,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -264951,7 +270242,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -265067,12 +270358,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -265116,9 +270408,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -265145,25 +270437,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -265243,9 +270539,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -265354,11 +270650,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -265382,9 +270678,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -265410,20 +270707,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -265523,14 +270821,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -265545,11 +270846,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -265598,11 +270900,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -265626,8 +270929,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -265697,11 +271000,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -265709,15 +271013,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -265736,7 +271046,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -265818,7 +271129,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -265862,14 +271173,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -265908,7 +271220,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -266003,7 +271315,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -266119,12 +271431,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -266168,9 +271481,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -266197,25 +271510,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -266295,9 +271612,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -266406,11 +271723,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -266434,9 +271751,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -266462,20 +271780,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -266575,14 +271894,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -266597,11 +271919,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -266650,11 +271973,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -266678,8 +272002,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -266749,11 +272073,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -266761,15 +272086,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -266788,7 +272119,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -266870,7 +272202,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -266914,14 +272246,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -266960,7 +272293,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -267055,7 +272388,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -267171,12 +272504,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -267220,9 +272554,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -267249,25 +272583,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -267347,9 +272685,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -267458,11 +272796,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -267486,9 +272824,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -267514,20 +272853,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -267627,14 +272967,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -267649,11 +272992,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -267702,11 +273046,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -267730,8 +273075,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -267801,11 +273146,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -267813,15 +273159,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -267840,7 +273192,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -267922,7 +273275,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -267966,14 +273319,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -268012,7 +273366,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -268107,7 +273461,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -268223,12 +273577,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -268272,9 +273627,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -268301,25 +273656,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -268399,9 +273758,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -268510,11 +273869,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -268538,9 +273897,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -268566,20 +273926,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -268679,14 +274040,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -268701,11 +274065,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -268754,11 +274119,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -268782,8 +274148,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -268853,11 +274219,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -268865,15 +274232,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -268892,7 +274265,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -268974,7 +274348,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -269018,14 +274392,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -269064,7 +274439,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -269159,7 +274534,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -269275,12 +274650,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -269324,9 +274700,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -269353,25 +274729,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -269451,9 +274831,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -269562,11 +274942,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -269590,9 +274970,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -269618,20 +274999,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -269731,14 +275113,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -269753,11 +275138,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -269806,11 +275192,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -269834,8 +275221,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -269905,11 +275292,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -269917,15 +275305,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -269944,7 +275338,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -270026,7 +275421,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -270070,14 +275465,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -270116,7 +275512,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -270211,7 +275607,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -270327,12 +275723,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -270376,9 +275773,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -270405,25 +275802,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -270503,9 +275904,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -270614,11 +276015,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -270642,9 +276043,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -270670,20 +276072,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -270783,14 +276186,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -270805,11 +276211,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -270858,11 +276265,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -270886,8 +276294,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -270957,11 +276365,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -270969,15 +276378,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -270996,7 +276411,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -271078,7 +276494,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -271122,14 +276538,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -271168,7 +276585,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -271263,7 +276680,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -271379,12 +276796,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -271428,9 +276846,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -271457,25 +276875,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -271555,9 +276977,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -271666,11 +277088,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -271694,9 +277116,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -271722,20 +277145,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -271835,14 +277259,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -271857,11 +277284,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -271910,11 +277338,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -271938,8 +277367,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -272009,11 +277438,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -272021,15 +277451,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -272048,7 +277484,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -272130,7 +277567,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -272174,14 +277611,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -272220,7 +277658,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -272315,7 +277753,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -272431,12 +277869,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -272480,9 +277919,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -272509,25 +277948,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -272607,9 +278050,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -272718,11 +278161,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -272746,9 +278189,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -272774,20 +278218,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -272887,14 +278332,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -272909,11 +278357,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -272962,11 +278411,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -272990,8 +278440,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -273061,11 +278511,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -273073,15 +278524,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -273100,7 +278557,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -273182,7 +278640,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -273226,14 +278684,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -273272,7 +278731,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -273367,7 +278826,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -273483,12 +278942,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -273532,9 +278992,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -273561,25 +279021,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -273659,9 +279123,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -273770,11 +279234,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -273798,9 +279262,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -273826,20 +279291,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -273939,14 +279405,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -273961,11 +279430,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -274014,11 +279484,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -274042,8 +279513,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -274113,11 +279584,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -274125,15 +279597,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -274152,7 +279630,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -274234,7 +279713,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -274278,14 +279757,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -274324,7 +279804,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -274419,7 +279899,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -274535,12 +280015,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -274584,9 +280065,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -274613,25 +280094,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -274711,9 +280196,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -274822,11 +280307,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -274850,9 +280335,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -274878,20 +280364,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -274991,14 +280478,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -275013,11 +280503,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -275066,11 +280557,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -275094,8 +280586,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -275165,11 +280657,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -275177,15 +280670,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -275204,7 +280703,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -275286,7 +280786,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -275330,14 +280830,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -275376,7 +280877,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -275471,7 +280972,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -275587,12 +281088,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -275636,9 +281138,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -275665,25 +281167,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -275763,9 +281269,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -275874,11 +281380,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -275902,9 +281408,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -275930,20 +281437,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -276043,14 +281551,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -276065,11 +281576,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -276118,11 +281630,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -276146,8 +281659,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -276217,11 +281730,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -276229,15 +281743,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -276256,7 +281776,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -276338,7 +281859,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -276382,14 +281903,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -276428,7 +281950,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -276523,7 +282045,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -276639,12 +282161,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -276688,9 +282211,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -276717,25 +282240,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -276815,9 +282342,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -276926,11 +282453,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -276954,9 +282481,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -276982,20 +282510,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -277095,14 +282624,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -277117,11 +282649,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -277170,11 +282703,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -277198,8 +282732,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -277269,11 +282803,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -277281,15 +282816,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -277308,7 +282849,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -277390,7 +282932,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -277434,14 +282976,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -277480,7 +283023,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -277575,7 +283118,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -277691,12 +283234,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -277740,9 +283284,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -277769,25 +283313,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -277867,9 +283415,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -277978,11 +283526,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -278006,9 +283554,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -278034,20 +283583,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -278147,14 +283697,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -278169,11 +283722,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -278222,11 +283776,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -278250,8 +283805,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -278321,11 +283876,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -278333,15 +283889,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -278360,7 +283922,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -278442,7 +284005,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -278486,14 +284049,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -278532,7 +284096,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -278627,7 +284191,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -278743,12 +284307,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -278792,9 +284357,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -278821,25 +284386,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -278919,9 +284488,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -279030,11 +284599,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -279058,9 +284627,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -279086,20 +284656,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -279199,14 +284770,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -279221,11 +284795,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -279274,11 +284849,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -279302,8 +284878,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -279373,11 +284949,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -279385,15 +284962,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -279412,7 +284995,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -279494,7 +285078,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -279538,14 +285122,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -279584,7 +285169,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -279679,7 +285264,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -279795,12 +285380,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -279844,9 +285430,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -279873,25 +285459,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -279971,9 +285561,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -280082,11 +285672,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -280110,9 +285700,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -280138,20 +285729,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -280251,14 +285843,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -280273,11 +285868,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -280326,11 +285922,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -280354,8 +285951,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -280425,11 +286022,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -280437,15 +286035,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -280464,7 +286068,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -280546,7 +286151,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -280590,14 +286195,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -280636,7 +286242,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -280731,7 +286337,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -280847,12 +286453,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -280896,9 +286503,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -280925,25 +286532,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -281023,9 +286634,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -281134,11 +286745,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -281162,9 +286773,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -281190,20 +286802,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -281303,14 +286916,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -281325,11 +286941,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -281378,11 +286995,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -281406,8 +287024,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -281477,11 +287095,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -281489,15 +287108,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -281516,7 +287141,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -281598,7 +287224,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -281642,14 +287268,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -281688,7 +287315,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -281783,7 +287410,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -281899,12 +287526,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -281948,9 +287576,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -281977,25 +287605,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -282075,9 +287707,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -282186,11 +287818,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -282214,9 +287846,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -282242,20 +287875,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -282355,14 +287989,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -282377,11 +288014,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -282430,11 +288068,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -282458,8 +288097,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -282529,11 +288168,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -282541,15 +288181,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -282568,7 +288214,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -282650,7 +288297,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -282694,14 +288341,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -282740,7 +288388,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -282835,7 +288483,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -282951,12 +288599,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -283000,9 +288649,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -283029,25 +288678,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -283127,9 +288780,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -283238,11 +288891,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -283266,9 +288919,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -283294,20 +288948,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -283407,14 +289062,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -283429,11 +289087,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -283482,11 +289141,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -283510,8 +289170,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -283581,11 +289241,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -283593,15 +289254,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -283620,7 +289287,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -283702,7 +289370,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -283746,14 +289414,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -283792,7 +289461,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -283887,7 +289556,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -284003,12 +289672,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -284052,9 +289722,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -284081,25 +289751,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -284179,9 +289853,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -284290,11 +289964,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -284318,9 +289992,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -284346,20 +290021,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -284459,14 +290135,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -284481,11 +290160,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -284534,11 +290214,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -284562,8 +290243,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -284633,11 +290314,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -284645,15 +290327,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -284672,7 +290360,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -284754,7 +290443,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -284798,14 +290487,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -284844,7 +290534,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -284939,7 +290629,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -285055,12 +290745,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -285104,9 +290795,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -285133,25 +290824,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -285231,9 +290926,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -285342,11 +291037,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -285370,9 +291065,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -285398,20 +291094,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -285511,14 +291208,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -285533,11 +291233,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -285586,11 +291287,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -285614,8 +291316,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -285685,11 +291387,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -285697,15 +291400,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -285724,7 +291433,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -285806,7 +291516,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -285850,14 +291560,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -285896,7 +291607,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -285991,7 +291702,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -286107,12 +291818,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -286156,9 +291868,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -286185,25 +291897,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -286283,9 +291999,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -286394,11 +292110,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -286422,9 +292138,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -286450,20 +292167,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -286563,14 +292281,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -286585,11 +292306,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -286638,11 +292360,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -286666,8 +292389,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -286737,11 +292460,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -286749,15 +292473,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -286776,7 +292506,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -286858,7 +292589,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -286902,14 +292633,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -286948,7 +292680,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -287043,7 +292775,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -287159,12 +292891,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -287208,9 +292941,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -287237,25 +292970,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -287335,9 +293072,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -287446,11 +293183,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -287474,9 +293211,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -287502,20 +293240,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -287615,14 +293354,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -287637,11 +293379,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -287690,11 +293433,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -287718,8 +293462,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -287789,11 +293533,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -287801,15 +293546,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -287828,7 +293579,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -287910,7 +293662,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -287954,14 +293706,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -288000,7 +293753,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -288095,7 +293848,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -288211,12 +293964,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -288260,9 +294014,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -288289,25 +294043,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -288387,9 +294145,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -288498,11 +294256,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -288526,9 +294284,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -288554,20 +294313,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -288667,14 +294427,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -288689,11 +294452,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -288742,11 +294506,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -288770,8 +294535,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -288841,11 +294606,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -288853,15 +294619,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -288880,7 +294652,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -288962,7 +294735,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -289006,14 +294779,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -289052,7 +294826,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -289147,7 +294921,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -289263,12 +295037,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -289312,9 +295087,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -289341,25 +295116,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -289439,9 +295218,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -289550,11 +295329,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -289578,9 +295357,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -289606,20 +295386,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -289719,14 +295500,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -289741,11 +295525,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -289794,11 +295579,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -289822,8 +295608,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -289893,11 +295679,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -289905,15 +295692,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -289932,7 +295725,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -290014,7 +295808,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -290058,14 +295852,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -290104,7 +295899,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -290199,7 +295994,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -290315,12 +296110,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -290364,9 +296160,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -290393,25 +296189,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -290491,9 +296291,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -290602,11 +296402,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -290630,9 +296430,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -290658,20 +296459,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -290771,14 +296573,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -290793,11 +296598,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -290846,11 +296652,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -290874,8 +296681,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -290945,11 +296752,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -290957,15 +296765,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -290984,7 +296798,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -291066,7 +296881,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -291110,14 +296925,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -291156,7 +296972,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -291251,7 +297067,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -291367,12 +297183,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -291416,9 +297233,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -291445,25 +297262,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -291543,9 +297364,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -291654,11 +297475,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -291682,9 +297503,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -291710,20 +297532,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -291823,14 +297646,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -291845,11 +297671,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -291898,11 +297725,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -291926,8 +297754,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -291997,11 +297825,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -292009,15 +297838,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -292036,7 +297871,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -292118,7 +297954,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -292162,14 +297998,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -292208,7 +298045,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -292303,7 +298140,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -292419,12 +298256,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -292468,9 +298306,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -292497,25 +298335,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -292595,9 +298437,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -292706,11 +298548,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -292734,9 +298576,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -292762,20 +298605,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -292875,14 +298719,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -292897,11 +298744,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -292950,11 +298798,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -292978,8 +298827,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -293049,11 +298898,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -293061,15 +298911,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -293088,7 +298944,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -293170,7 +299027,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -293214,14 +299071,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -293260,7 +299118,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -293355,7 +299213,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -293471,12 +299329,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -293520,9 +299379,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -293549,25 +299408,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -293647,9 +299510,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -293758,11 +299621,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -293786,9 +299649,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -293814,20 +299678,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -293927,14 +299792,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -293949,11 +299817,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -294002,11 +299871,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -294030,8 +299900,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -294101,11 +299971,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -294113,15 +299984,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -294140,7 +300017,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -294222,7 +300100,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -294266,14 +300144,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -294312,7 +300191,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -294407,7 +300286,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -294523,12 +300402,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -294572,9 +300452,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -294601,25 +300481,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -294699,9 +300583,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -294810,11 +300694,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -294838,9 +300722,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -294866,20 +300751,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -294979,14 +300865,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -295001,11 +300890,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -295054,11 +300944,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -295082,8 +300973,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -295153,11 +301044,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -295165,15 +301057,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -295192,7 +301090,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -295274,7 +301173,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -295318,14 +301217,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -295364,7 +301264,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -295459,7 +301359,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -295575,12 +301475,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -295624,9 +301525,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -295653,25 +301554,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -295751,9 +301656,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -295862,11 +301767,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -295890,9 +301795,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -295918,20 +301824,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -296031,14 +301938,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -296053,11 +301963,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -296106,11 +302017,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -296134,8 +302046,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -296205,11 +302117,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -296217,15 +302130,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -296244,7 +302163,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -296326,7 +302246,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -296370,14 +302290,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -296416,7 +302337,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -296511,7 +302432,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -296627,12 +302548,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -296676,9 +302598,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -296705,25 +302627,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -296803,9 +302729,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -296914,11 +302840,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -296942,9 +302868,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -296970,20 +302897,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -297083,14 +303011,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -297105,11 +303036,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -297158,11 +303090,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -297186,8 +303119,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -297257,11 +303190,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -297269,15 +303203,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -297296,7 +303236,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -297378,7 +303319,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -297422,14 +303363,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -297468,7 +303410,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -297563,7 +303505,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -297679,12 +303621,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -297728,9 +303671,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -297757,25 +303700,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -297855,9 +303802,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -297966,11 +303913,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -297994,9 +303941,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -298022,20 +303970,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -298135,14 +304084,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -298157,11 +304109,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -298210,11 +304163,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -298238,8 +304192,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -298309,11 +304263,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -298321,15 +304276,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -298348,7 +304309,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -298430,7 +304392,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -298474,14 +304436,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -298520,7 +304483,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -298615,7 +304578,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -298731,12 +304694,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -298780,9 +304744,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -298809,25 +304773,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -298907,9 +304875,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -299018,11 +304986,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -299046,9 +305014,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -299074,20 +305043,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -299187,14 +305157,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -299209,11 +305182,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -299262,11 +305236,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -299290,8 +305265,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -299361,11 +305336,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -299373,15 +305349,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -299400,7 +305382,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -299482,7 +305465,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -299526,14 +305509,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -299572,7 +305556,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -299667,7 +305651,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -299783,12 +305767,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -299832,9 +305817,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -299861,25 +305846,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -299959,9 +305948,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -300070,11 +306059,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -300098,9 +306087,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -300126,20 +306116,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -300239,14 +306230,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -300261,11 +306255,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -300314,11 +306309,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -300342,8 +306338,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -300413,11 +306409,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -300425,15 +306422,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -300452,7 +306455,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -300534,7 +306538,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -300578,14 +306582,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -300624,7 +306629,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -300719,7 +306724,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -300835,12 +306840,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -300884,9 +306890,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -300913,25 +306919,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -301011,9 +307021,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -301122,11 +307132,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -301150,9 +307160,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -301178,20 +307189,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -301291,14 +307303,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -301313,11 +307328,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -301366,11 +307382,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -301394,8 +307411,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -301465,11 +307482,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -301477,15 +307495,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -301504,7 +307528,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -301586,7 +307611,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -301630,14 +307655,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -301676,7 +307702,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -301771,7 +307797,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -301887,12 +307913,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -301936,9 +307963,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -301965,25 +307992,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -302063,9 +308094,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -302174,11 +308205,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -302202,9 +308233,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -302230,20 +308262,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -302343,14 +308376,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -302365,11 +308401,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -302418,11 +308455,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -302446,8 +308484,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -302517,11 +308555,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -302529,15 +308568,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -302556,7 +308601,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -302638,7 +308684,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -302682,14 +308728,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -302728,7 +308775,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -302823,7 +308870,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -302939,12 +308986,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -302988,9 +309036,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -303017,25 +309065,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -303115,9 +309167,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -303226,11 +309278,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -303254,9 +309306,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -303282,20 +309335,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -303395,14 +309449,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -303417,11 +309474,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -303470,11 +309528,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -303498,8 +309557,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -303569,11 +309628,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -303581,15 +309641,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -303608,7 +309674,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -303690,7 +309757,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -303734,14 +309801,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -303780,7 +309848,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -303875,7 +309943,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -303991,12 +310059,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -304040,9 +310109,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -304069,25 +310138,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -304167,9 +310240,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -304278,11 +310351,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -304306,9 +310379,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -304334,20 +310408,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -304447,14 +310522,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -304469,11 +310547,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -304522,11 +310601,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -304550,8 +310630,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -304621,11 +310701,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -304633,15 +310714,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -304660,7 +310747,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -304742,7 +310830,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -304786,14 +310874,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -304832,7 +310921,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -304927,7 +311016,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -305043,12 +311132,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -305092,9 +311182,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -305121,25 +311211,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -305219,9 +311313,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -305330,11 +311424,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -305358,9 +311452,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -305386,20 +311481,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -305499,14 +311595,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -305521,11 +311620,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -305574,11 +311674,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -305602,8 +311703,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -305673,11 +311774,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -305685,15 +311787,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -305712,7 +311820,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -305794,7 +311903,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -305838,14 +311947,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -305884,7 +311994,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -305979,7 +312089,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -306095,12 +312205,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -306144,9 +312255,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -306173,25 +312284,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -306271,9 +312386,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -306382,11 +312497,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -306410,9 +312525,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -306438,20 +312554,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -306551,14 +312668,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -306573,11 +312693,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -306626,11 +312747,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -306654,8 +312776,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -306725,11 +312847,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -306737,15 +312860,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -306764,7 +312893,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -306846,7 +312976,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -306890,14 +313020,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -306936,7 +313067,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -307031,7 +313162,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -307147,12 +313278,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -307196,9 +313328,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -307225,25 +313357,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -307323,9 +313459,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -307434,11 +313570,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -307462,9 +313598,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -307490,20 +313627,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -307603,14 +313741,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -307625,11 +313766,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -307678,11 +313820,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -307706,8 +313849,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -307777,11 +313920,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -307789,15 +313933,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -307816,7 +313966,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -307898,7 +314049,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -307942,14 +314093,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -307988,7 +314140,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -308083,7 +314235,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -308199,12 +314351,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -308248,9 +314401,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -308277,25 +314430,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -308375,9 +314532,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -308486,11 +314643,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -308514,9 +314671,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -308542,20 +314700,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -308655,14 +314814,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -308677,11 +314839,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -308730,11 +314893,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -308758,8 +314922,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -308829,11 +314993,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -308841,15 +315006,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -308868,7 +315039,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -308950,7 +315122,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -308994,14 +315166,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -309040,7 +315213,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -309135,7 +315308,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -309251,12 +315424,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -309300,9 +315474,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -309329,25 +315503,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -309427,9 +315605,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -309538,11 +315716,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -309566,9 +315744,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -309594,20 +315773,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -309707,14 +315887,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -309729,11 +315912,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -309782,11 +315966,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -309810,8 +315995,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -309881,11 +316066,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -309893,15 +316079,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -309920,7 +316112,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -310002,7 +316195,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -310046,14 +316239,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -310092,7 +316286,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -310187,7 +316381,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -310303,12 +316497,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -310352,9 +316547,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -310381,25 +316576,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -310479,9 +316678,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -310590,11 +316789,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -310618,9 +316817,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -310646,20 +316846,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -310759,14 +316960,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -310781,11 +316985,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -310834,11 +317039,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -310862,8 +317068,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -310933,11 +317139,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -310945,15 +317152,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -310972,7 +317185,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -311054,7 +317268,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -311098,14 +317312,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -311144,7 +317359,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -311239,7 +317454,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -311355,12 +317570,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -311404,9 +317620,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -311433,25 +317649,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -311531,9 +317751,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -311642,11 +317862,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -311670,9 +317890,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -311698,20 +317919,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -311811,14 +318033,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -311833,11 +318058,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -311886,11 +318112,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -311914,8 +318141,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -311985,11 +318212,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -311997,15 +318225,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -312024,7 +318258,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -312106,7 +318341,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -312150,14 +318385,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -312196,7 +318432,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -312291,7 +318527,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -312407,12 +318643,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -312456,9 +318693,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -312485,25 +318722,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -312583,9 +318824,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -312694,11 +318935,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -312722,9 +318963,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -312750,20 +318992,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -312863,14 +319106,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -312885,11 +319131,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -312938,11 +319185,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -312966,8 +319214,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -313037,11 +319285,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -313049,15 +319298,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -313076,7 +319331,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -313158,7 +319414,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -313202,14 +319458,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -313248,7 +319505,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -313343,7 +319600,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -313459,12 +319716,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -313508,9 +319766,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -313537,25 +319795,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -313635,9 +319897,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -313746,11 +320008,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -313774,9 +320036,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -313802,20 +320065,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -313915,14 +320179,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -313937,11 +320204,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -313990,11 +320258,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -314018,8 +320287,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -314089,11 +320358,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -314101,15 +320371,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -314128,7 +320404,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -314210,7 +320487,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -314254,14 +320531,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -314300,7 +320578,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -314395,7 +320673,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -314511,12 +320789,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -314560,9 +320839,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -314589,25 +320868,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -314687,9 +320970,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -314798,11 +321081,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -314826,9 +321109,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -314854,20 +321138,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -314967,14 +321252,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -314989,11 +321277,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -315042,11 +321331,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -315070,8 +321360,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -315141,11 +321431,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -315153,15 +321444,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -315180,7 +321477,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -315262,7 +321560,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -315306,14 +321604,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -315352,7 +321651,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -315447,7 +321746,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -315563,12 +321862,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -315612,9 +321912,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -315641,25 +321941,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -315739,9 +322043,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -315850,11 +322154,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -315878,9 +322182,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -315906,20 +322211,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -316019,14 +322325,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -316041,11 +322350,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -316094,11 +322404,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -316122,8 +322433,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -316193,11 +322504,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -316205,15 +322517,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -316232,7 +322550,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -316314,7 +322633,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -316358,14 +322677,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -316404,7 +322724,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -316499,7 +322819,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -316615,12 +322935,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -316664,9 +322985,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -316693,25 +323014,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -316791,9 +323116,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -316902,11 +323227,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -316930,9 +323255,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -316958,20 +323284,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -317071,14 +323398,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -317093,11 +323423,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -317146,11 +323477,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -317174,8 +323506,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -317245,11 +323577,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -317257,15 +323590,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -317284,7 +323623,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -317366,7 +323706,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -317410,14 +323750,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -317456,7 +323797,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -317551,7 +323892,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -317667,12 +324008,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -317716,9 +324058,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -317745,25 +324087,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -317843,9 +324189,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -317954,11 +324300,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -317982,9 +324328,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -318010,20 +324357,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -318123,14 +324471,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -318145,11 +324496,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -318198,11 +324550,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -318226,8 +324579,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -318297,11 +324650,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -318309,15 +324663,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -318336,7 +324696,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -318418,7 +324779,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -318462,14 +324823,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -318508,7 +324870,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -318603,7 +324965,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -318719,12 +325081,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -318768,9 +325131,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -318797,25 +325160,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -318895,9 +325262,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -319006,11 +325373,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -319034,9 +325401,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -319062,20 +325430,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -319175,14 +325544,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -319197,11 +325569,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -319250,11 +325623,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -319278,8 +325652,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -319349,11 +325723,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -319361,15 +325736,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -319388,7 +325769,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -319470,7 +325852,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -319514,14 +325896,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -319560,7 +325943,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -319655,7 +326038,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -319771,12 +326154,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -319820,9 +326204,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -319849,25 +326233,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -319947,9 +326335,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -320058,11 +326446,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -320086,9 +326474,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -320114,20 +326503,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -320227,14 +326617,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -320249,11 +326642,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -320302,11 +326696,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -320330,8 +326725,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -320401,11 +326796,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -320413,15 +326809,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -320440,7 +326842,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -320522,7 +326925,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -320566,14 +326969,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -320612,7 +327016,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -320707,7 +327111,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -320823,12 +327227,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -320872,9 +327277,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -320901,25 +327306,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -320999,9 +327408,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -321110,11 +327519,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -321138,9 +327547,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -321166,20 +327576,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -321279,14 +327690,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -321301,11 +327715,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -321354,11 +327769,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -321382,8 +327798,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -321453,11 +327869,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -321465,15 +327882,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -321492,7 +327915,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -321574,7 +327998,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -321618,14 +328042,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -321664,7 +328089,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -321759,7 +328184,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -321875,12 +328300,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -321924,9 +328350,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -321953,25 +328379,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -322051,9 +328481,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -322162,11 +328592,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -322190,9 +328620,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -322218,20 +328649,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -322331,14 +328763,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -322353,11 +328788,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -322406,11 +328842,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -322434,8 +328871,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -322505,11 +328942,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -322517,15 +328955,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -322544,7 +328988,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -322626,7 +329071,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -322670,14 +329115,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -322716,7 +329162,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -322811,7 +329257,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -322927,12 +329373,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -322976,9 +329423,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -323005,25 +329452,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -323103,9 +329554,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -323214,11 +329665,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -323242,9 +329693,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -323270,20 +329722,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -323383,14 +329836,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -323405,11 +329861,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -323458,11 +329915,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -323486,8 +329944,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -323557,11 +330015,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -323569,15 +330028,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -323596,7 +330061,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -323678,7 +330144,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -323722,14 +330188,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -323768,7 +330235,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -323863,7 +330330,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -323979,12 +330446,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -324028,9 +330496,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -324057,25 +330525,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -324155,9 +330627,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -324266,11 +330738,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -324294,9 +330766,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -324322,20 +330795,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -324435,14 +330909,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -324457,11 +330934,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -324510,11 +330988,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -324538,8 +331017,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -324609,11 +331088,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -324621,15 +331101,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -324648,7 +331134,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -324730,7 +331217,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -324774,14 +331261,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -324820,7 +331308,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -324915,7 +331403,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -325031,12 +331519,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -325080,9 +331569,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -325109,25 +331598,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -325207,9 +331700,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -325318,11 +331811,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -325346,9 +331839,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -325374,20 +331868,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -325487,14 +331982,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -325509,11 +332007,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -325562,11 +332061,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -325590,8 +332090,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -325661,11 +332161,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -325673,15 +332174,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -325700,7 +332207,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -325782,7 +332290,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -325826,14 +332334,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -325872,7 +332381,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -325967,7 +332476,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -326083,12 +332592,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -326132,9 +332642,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -326161,25 +332671,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -326259,9 +332773,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -326370,11 +332884,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -326398,9 +332912,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -326426,20 +332941,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -326539,14 +333055,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -326561,11 +333080,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -326614,11 +333134,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -326642,8 +333163,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -326713,11 +333234,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -326725,15 +333247,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -326752,7 +333280,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -326834,7 +333363,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -326878,14 +333407,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -326924,7 +333454,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -327019,7 +333549,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -327135,12 +333665,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -327184,9 +333715,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -327213,25 +333744,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -327311,9 +333846,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -327422,11 +333957,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -327450,9 +333985,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -327478,20 +334014,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -327591,14 +334128,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -327613,11 +334153,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -327666,11 +334207,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -327694,8 +334236,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -327765,11 +334307,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -327777,15 +334320,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -327804,7 +334353,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -327886,7 +334436,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -327930,14 +334480,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -327976,7 +334527,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -328071,7 +334622,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -328187,12 +334738,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -328236,9 +334788,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -328265,25 +334817,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -328363,9 +334919,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -328474,11 +335030,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -328502,9 +335058,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -328530,20 +335087,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -328643,14 +335201,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -328665,11 +335226,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -328718,11 +335280,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -328746,8 +335309,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -328817,11 +335380,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -328829,15 +335393,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -328856,7 +335426,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -328938,7 +335509,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -328982,14 +335553,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -329028,7 +335600,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -329123,7 +335695,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -329239,12 +335811,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -329288,9 +335861,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -329317,25 +335890,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -329415,9 +335992,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -329526,11 +336103,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -329554,9 +336131,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -329582,20 +336160,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -329695,14 +336274,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -329717,11 +336299,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -329770,11 +336353,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -329798,8 +336382,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -329869,11 +336453,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -329881,15 +336466,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -329908,7 +336499,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -329990,7 +336582,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -330034,14 +336626,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -330080,7 +336673,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -330175,7 +336768,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -330291,12 +336884,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -330340,9 +336934,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -330369,25 +336963,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -330467,9 +337065,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -330578,11 +337176,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -330606,9 +337204,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -330634,20 +337233,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -330747,14 +337347,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -330769,11 +337372,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -330822,11 +337426,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -330850,8 +337455,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -330921,11 +337526,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -330933,15 +337539,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -330960,7 +337572,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -331042,7 +337655,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -331086,14 +337699,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -331132,7 +337746,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -331227,7 +337841,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -331343,12 +337957,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -331392,9 +338007,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -331421,25 +338036,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -331519,9 +338138,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -331630,11 +338249,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -331658,9 +338277,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -331686,20 +338306,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -331799,14 +338420,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -331821,11 +338445,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -331874,11 +338499,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -331902,8 +338528,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -331973,11 +338599,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -331985,15 +338612,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -332012,7 +338645,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -332094,7 +338728,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -332138,14 +338772,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -332184,7 +338819,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -332279,7 +338914,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -332395,12 +339030,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -332444,9 +339080,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -332473,25 +339109,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -332571,9 +339211,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -332682,11 +339322,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -332710,9 +339350,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -332738,20 +339379,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -332851,14 +339493,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -332873,11 +339518,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -332926,11 +339572,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -332954,8 +339601,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -333025,11 +339672,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -333037,15 +339685,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -333064,7 +339718,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -333146,7 +339801,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -333190,14 +339845,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -333236,7 +339892,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -333331,7 +339987,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -333447,12 +340103,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -333496,9 +340153,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -333525,25 +340182,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -333623,9 +340284,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -333734,11 +340395,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -333762,9 +340423,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -333790,20 +340452,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -333903,14 +340566,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -333925,11 +340591,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -333978,11 +340645,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -334006,8 +340674,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -334077,11 +340745,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -334089,15 +340758,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -334116,7 +340791,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -334198,7 +340874,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -334242,14 +340918,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -334288,7 +340965,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -334383,7 +341060,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -334499,12 +341176,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -334548,9 +341226,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -334577,25 +341255,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -334675,9 +341357,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -334786,11 +341468,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -334814,9 +341496,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -334842,20 +341525,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -334955,14 +341639,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -334977,11 +341664,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -335030,11 +341718,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -335058,8 +341747,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -335129,11 +341818,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -335141,15 +341831,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -335168,7 +341864,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -335250,7 +341947,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -335294,14 +341991,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -335340,7 +342038,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -335435,7 +342133,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -335551,12 +342249,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -335600,9 +342299,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -335629,25 +342328,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -335727,9 +342430,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -335838,11 +342541,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -335866,9 +342569,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -335894,20 +342598,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -336007,14 +342712,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -336029,11 +342737,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -336082,11 +342791,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -336110,8 +342820,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -336181,11 +342891,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -336193,15 +342904,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -336220,7 +342937,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -336302,7 +343020,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -336346,14 +343064,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -336392,7 +343111,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -336487,7 +343206,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -336603,12 +343322,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -336652,9 +343372,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -336681,25 +343401,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -336779,9 +343503,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -336890,11 +343614,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -336918,9 +343642,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -336946,20 +343671,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -337059,14 +343785,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -337081,11 +343810,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -337134,11 +343864,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -337162,8 +343893,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -337233,11 +343964,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -337245,15 +343977,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -337272,7 +344010,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -337354,7 +344093,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -337398,14 +344137,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -337444,7 +344184,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -337539,7 +344279,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -337655,12 +344395,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -337704,9 +344445,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -337733,25 +344474,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -337831,9 +344576,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -337942,11 +344687,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -337970,9 +344715,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -337998,20 +344744,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -338111,14 +344858,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -338133,11 +344883,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -338186,11 +344937,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -338214,8 +344966,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -338285,11 +345037,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -338297,15 +345050,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -338324,7 +345083,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -338406,7 +345166,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -338450,14 +345210,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -338496,7 +345257,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -338591,7 +345352,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -338707,12 +345468,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -338756,9 +345518,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -338785,25 +345547,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -338883,9 +345649,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -338994,11 +345760,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -339022,9 +345788,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -339050,20 +345817,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -339163,14 +345931,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -339185,11 +345956,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -339238,11 +346010,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -339266,8 +346039,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -339337,11 +346110,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -339349,15 +346123,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -339376,7 +346156,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -339458,7 +346239,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -339502,14 +346283,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -339548,7 +346330,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -339643,7 +346425,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -339759,12 +346541,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -339808,9 +346591,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -339837,25 +346620,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -339935,9 +346722,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -340046,11 +346833,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -340074,9 +346861,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -340102,20 +346890,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -340215,14 +347004,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -340237,11 +347029,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -340290,11 +347083,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -340318,8 +347112,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -340389,11 +347183,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -340401,15 +347196,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -340428,7 +347229,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -340510,7 +347312,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -340554,14 +347356,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -340600,7 +347403,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -340695,7 +347498,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -340811,12 +347614,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -340860,9 +347664,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -340889,25 +347693,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -340987,9 +347795,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -341098,11 +347906,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -341126,9 +347934,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -341154,20 +347963,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -341267,14 +348077,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -341289,11 +348102,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -341342,11 +348156,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -341370,8 +348185,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -341441,11 +348256,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -341453,15 +348269,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -341480,7 +348302,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -341562,7 +348385,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -341606,14 +348429,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -341652,7 +348476,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -341747,7 +348571,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -341863,12 +348687,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -341912,9 +348737,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -341941,25 +348766,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -342039,9 +348868,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -342150,11 +348979,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -342178,9 +349007,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -342206,20 +349036,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -342319,14 +349150,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -342341,11 +349175,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -342394,11 +349229,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -342422,8 +349258,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -342493,11 +349329,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -342505,15 +349342,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -342532,7 +349375,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -342614,7 +349458,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -342658,14 +349502,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -342704,7 +349549,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -342799,7 +349644,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -342915,12 +349760,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -342964,9 +349810,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -342993,25 +349839,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -343091,9 +349941,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -343202,11 +350052,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -343230,9 +350080,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -343258,20 +350109,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -343371,14 +350223,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -343393,11 +350248,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -343446,11 +350302,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -343474,8 +350331,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -343545,11 +350402,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -343557,15 +350415,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -343584,7 +350448,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -343666,7 +350531,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -343710,14 +350575,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -343756,7 +350622,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -343851,7 +350717,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -343967,12 +350833,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -344016,9 +350883,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -344045,25 +350912,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -344143,9 +351014,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -344254,11 +351125,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -344282,9 +351153,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -344310,20 +351182,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -344423,14 +351296,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -344445,11 +351321,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -344498,11 +351375,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -344526,8 +351404,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -344597,11 +351475,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -344609,15 +351488,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -344636,7 +351521,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -344718,7 +351604,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -344762,14 +351648,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -344808,7 +351695,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -344903,7 +351790,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -345019,12 +351906,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -345068,9 +351956,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -345097,25 +351985,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -345195,9 +352087,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -345306,11 +352198,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -345334,9 +352226,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -345362,20 +352255,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -345475,14 +352369,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -345497,11 +352394,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -345550,11 +352448,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -345578,8 +352477,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -345649,11 +352548,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -345661,15 +352561,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -345688,7 +352594,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -345770,7 +352677,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -345814,14 +352721,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -345860,7 +352768,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -345955,7 +352863,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -346071,12 +352979,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -346120,9 +353029,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -346149,25 +353058,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -346247,9 +353160,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -346358,11 +353271,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -346386,9 +353299,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -346414,20 +353328,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -346527,14 +353442,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -346549,11 +353467,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -346602,11 +353521,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -346630,8 +353550,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -346701,11 +353621,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -346713,15 +353634,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -346740,7 +353667,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -346822,7 +353750,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -346866,14 +353794,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -346912,7 +353841,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -347007,7 +353936,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -347123,12 +354052,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -347172,9 +354102,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -347201,25 +354131,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -347299,9 +354233,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -347410,11 +354344,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,14 T1218.007,No,-,0 @@ -347438,9 +354372,10 @@ T1024,No,-,0 T1536,No,-,0 T1091,No,-,0 T1005,No,-,0 -T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,1 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/certutil_with_decode_argument.yml,2 +T1140,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_using_memory_as_backing_store.yml,2 T1137.005,No,-,0 -T1562,No,-,24 +T1562,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/unloading_amsi_via_reflection.yml,25 T1586.002,No,-,0 T1608.001,No,-,0 T1195,No,-,0 @@ -347466,20 +354401,21 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1552,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/monitor_registry_keys_for_print_monitors.yml,1 T1037.002,No,-,0 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,14 -T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,14 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/cobalt_strike_named_pipes.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/dllhost_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_remote_thread_to_known_windows_process.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/searchprotocolhost_with_no_command_line_with_network.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_dllhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_gpupdate_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml,15 +T1055,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/trickbot_named_pipe.yml,15 T1139,No,-,0 T1205,No,-,0 T1503,No,-,0 @@ -347579,14 +354515,17 @@ T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/c T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_new_local_admin_account.yml,3 T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/short_lived_windows_accounts.yml,3 T1092,No,-,0 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,2 -T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,2 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disable_logs_using_wevtutil.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_event_log_service_behavior.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_wevtutil_usage.yml,4 +T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/windows_event_log_cleared.yml,4 T1585.002,No,-,0 T1557.001,No,-,0 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,5 -T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,5 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_cacls_app.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_deny_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/icacls_grant_command.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/modify_acl_permission_to_files_or_folder.yml,6 +T1222,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/permission_modification_using_takeown_app.yml,6 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/access_lsass_memory_for_dump_creation.yml,10 @@ -347601,11 +354540,12 @@ T1053.001,No,-,0 T1179,No,-,0 T1595,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1547.011,No,-,0 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,10 -T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,10 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/allow_operation_with_consent_admin.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/services_escalate_exe.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,11 +T1548,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,11 T1134.002,No,-,0 T1548.001,No,-,0 T1547.004,No,-,0 @@ -347654,11 +354594,12 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,16 T1087,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,16 T1090,No,-,0 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,20 -T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,20 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___first_time_seen_cmd_line.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml,27 +T1059,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml,27 T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 @@ -347682,8 +354623,8 @@ T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/deprecated T1036.002,No,-,0 T1588.001,No,-,0 T1542.002,No,-,0 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,5 -T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,5 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml,8 +T1070,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/usn_journal_deletion.yml,8 T1048.001,No,-,0 T1137.001,No,-,0 T1583.003,No,-,0 @@ -347753,11 +354694,12 @@ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__ T1057,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1562.003,No,-,0 T1053.004,No,-,0 -T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,1 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_wmi_event_subscription_persistence.yml,2 +T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_permanent_event_subscription___sysmon.yml,2 T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 -T1072,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1072,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 @@ -347765,15 +354707,21 @@ T1060,No,-,0 T1606,No,-,0 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2 T1554,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,9 -T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,9 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/first_time_seen_command_line_argument.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadfile.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/any_powershell_downloadstring.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_empire_with_powershell_script_block_logging.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___execution_policy_bypass.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/nishang_powershelltcponeline.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_domain_enumeration.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_processing_stream_of_data.yml,15 +T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,15 T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 @@ -347792,7 +354740,8 @@ T1142,No,-,0 T1534,No,-,0 T1169,No,-,0 T1574.010,No,-,0 -T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,1 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/registry_keys_used_for_persistence.yml,2 +T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/start_up_during_safe_mode_boot.yml,2 T1199,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createaccesskey.yml,6 T1136.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_createloginprofile.yml,6 @@ -347874,7 +354823,7 @@ T1584.006,No,-,0 T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 -T1027.005,No,-,0 +T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,1 T1204.003,No,-,0 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44 @@ -347918,14 +354867,15 @@ T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/disab T1531,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/excessive_usage_of_net_app.yml,3 T1110.004,No,-,0 T1208,No,-,0 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,2 -T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,2 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/malicious_powershell_process___encoded_command.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml,4 +T1027,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wermgr_process_create_executable_file.yml,4 T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_suspicious_rights_delegation.yml,1 T1036.001,No,-,0 T1564.006,No,-,0 T1154,No,-,0 T1201,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml,1 -T1546,No,-,7 +T1546,No,-,8 T1546.004,No,-,0 T1187,No,-,0 T1134.005,No,-,0 @@ -347964,7 +354914,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/s T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_processes_run_from_unexpected_locations.yml,7 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,1 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -348059,7 +355009,7 @@ T1556.001,No,-,0 T1537,No,-,0 T1130,No,-,0 T1022,No,-,0 -T1070.004,No,-,0 +T1070.004,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clear_unallocated_sector_using_cipher_app.yml,1 T1189,Yes,https://github.com/splunk/security_content/blob/develop/network/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 T1498,No,-,0 T1595.001,No,-,0 @@ -348175,12 +355125,13 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/cloud/o365_exc T1556,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3 T1056.004,No,-,0 T1495,No,-,0 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,6 -T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,6 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/bcdedit_failure_recovery_modification.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/delete_shadowcopy_with_powershell.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/deleting_shadow_copies.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/known_services_killed_by_ransomware.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/resize_shadowstorage_volume.yml,7 +T1490,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wbadmin_delete_system_backups.yml,7 T1546.007,No,-,0 T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1 T1090.001,No,-,0 @@ -348224,9 +355175,9 @@ T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/a T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_7_zip.yml,3 T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_renamed_winrar.yml,3 T1021.005,No,-,0 -T1047,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/process_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_process_instantiation_via_wmi.yml,5 +T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/remote_wmi_command_attempt.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/script_execution_via_wmi.yml,5 T1047,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,5 T1156,No,-,0 @@ -348253,25 +355204,29 @@ T1150,No,-,0 T1556.003,No,-,0 T1578.004,No,-,0 T1148,No,-,0 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4 -T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,4 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_avproduct_through_pwh_or_wmi.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/recon_using_wmi_class.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml,7 +T1592,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/wmi_recon_running_process_or_services.yml,7 T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,33 -T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,33 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_dsinternals_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_lazagne_command_options.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_mimikatz_modules.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml,34 +T1003,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___credential_extraction_powersploit_modules.yml,34 T1129,No,-,0 T1602,No,-,0 T1561.002,No,-,0 @@ -348351,9 +355306,9 @@ T1110.002,No,-,0 T1178,No,-,0 T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/mailsniper_invoke_functions.yml,1 T1555.001,No,-,0 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 -T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,5 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1547,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 T1003.004,No,-,0 T1013,No,-,0 T1600,No,-,0 @@ -348462,11 +355417,11 @@ T1505.002,No,-,0 T1082,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/system_information_discovery_detection.yml,1 T1071,No,-,3 T1074.002,No,-,0 -T1053,Yes,https://github.com/splunk/security_content/blob/develop/deprecated/ssa___rare_parent_process_relationship_lolbas.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_http_command_arguments.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schedule_task_with_rundll32_command_trigger.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/schtasks_run_task_on_demand.yml,14 T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,14 +T1053,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___rare_parent_process_relationship_lolbas.yml,14